Improving Windows Authentication performance on IIS

Question

We're struggling with performance issues with a ASP.NET MVC site that is using Windows Authentication.

Response time is very slow on the first request to the site when the user is being authenticated. Further, every time the Authorization header is sent from the browser the response time increases with many seconds. The same issue occurs for both executed files and static content like CSS and JS.

Access to the application is restricted to users within a certain role and we are now planning to allow access to static files for all authenticated users to see if that helps.

The authentication method in use is NTLM.

How should we go forward in pinpointing why authentication decreases performance drastically?

Are the users domain users or local ones? If there are domain users, I would test the same with a local user to see if it is still slow. — Peter Hahndorf, Oct 23 '13 at 09:46
The users are domain users. Will perform the test you have outline above. — flalar, Oct 25 '13 at 12:14

score 3 · Accepted Answer · answered Nov 30 '15 at 15:17

The issue was quite difficult to figure out. After doing investigations for quite some time we found that it was sporadic and not always present.

We used nltest /dclist:<domain_name> to get a full list of all the domain controllers in customers environment and found they had 13 of them. By using nltest /dsgetdc:<domain_name> we could see that whenever the server was hocked up to the primary domain controller (PDC), authentication was slow due to high traffic/load on the DC. Whenever the application was utilizing one of the other twelve domain controllers the site was fine.

We could reproduce the issue with performing LDAP lookups against a specific DC, As the application was doing lots LDAP lookups as well hardcoding a DC other than the PDC could help the situation but would lead to single point of failure scenario.

The solution was to designate a separate site with two DC’s that would serve the mentioned application and others

Improving Windows Authentication performance on IIS

1 Answers1