UDS taking too long to respond for User retrieval from Active directory when referrals are enabled, How to disable AD referrals in UDS?

Products

• CA Advanced Authentication
• CA Strong Authentication
• CA Risk Authentication
• CA Advanced Authentication - Strong Authentication (AuthMinder / WebFort)
• CA Advanced Authentication - Risk Authentication (RiskMinder / RiskFort)

Issue/Introduction

We are experiencing long delays and performance issues when authenticating the users against our Enterprise Active Directory from Advanced Auth. The UDS seems to be taking too long to bind and unbind from AD to query for the user logging in. 

Environment

Release : 9.x

Components: AuthMinder(Arcot WebFort) CA Strong Authentication

RiskMinder(Arcot RiskFort) CA Risk Authentication

Cause

Active Directory has referrals enabled and UDS follows the referrals by default, in this scenario we have seen UDS taking longer as AD is following the referrals.

Active Directory Referrals   

Resolution

We have made changes in the product to not follow the AD referrals as this has caused issues when a user lookup is done. Please follow the below suggestion to enable it.

Add a flag like following in the arcotcommon.ini, You can add this section at the bottom of the arcotcommon.ini file : 

[arcot/extn] 
LDAP_REFFERAL_IGNORE_FLAG=ignore 

This needs a restart so apply the changes in all server one at a time and restart the application server hosting the UDS service. Strong Auth and Risk Auth services need to restarted as well.

You can follow the below KB article for proper stop/start sequence.

Start/Stop sequence for Advanced Authentication components