Is it better to grant access via multiple OU and group assignments in the security role or use a business unit?

Question

I have 18 domains managed by Adaxes and have noticed that Admin (full access) t all objects acts normally, but for piecemeal scopes like Service Desk that scopes to individual OUs and groups with a few implicit denies as well are very slow to load and things like the "add to group" can take a minute or more to display.

Would it be better to put those scopes into a business unit and use the business unit in the security role "assigned over"?

I have 42 assignments for that security role (including 16 denies) and expect it to grow as we add more domains.

Comments

Hello,

First of all, if you want a user to have unrestricted permissions in Adaxes, there is no need to use security roles. You can add the user to the service administrators list: https://www.adaxes.com/help/AddRemoveServiceAdministrators.

Using a business unit will not work better. Also, it does not allow you using OUs as subtree, which means that you will need to add all objects (user, groups, subOUs, etc.) to the unit explicitly.

Such slowness can be observed when you have lots of security roles (100+) and lots of assignments (200+) in a role. In your case, the slowness does not seem to be related to user permissions. To help us troubleshoot the issue, please, provide the following details:

1. What operations are performed slow? What about logging in to the Web interface?
2. Are the operations also slow in the Administration console?
3. Did you try to sign in with the credentials of the Adaxes service account (specified during Adaxes installation)? Is it also slow when performing operations as this account?
4. On how many computers is the Web interface installed? On how many computers is Adaxes service installed? Are the Web interfaces and Adaxes services installed on the same computer(s)?
5. Do you have at least 1 DC for each managed domain in the same AD site as Adaxes?

---

1. The slowness is mainly on the home page where we have many reports pulling from all the managed domains. As well as when viewing a user object, the memberOf section will not show the "More" button when selecting a group. Sometimes it can take 2 minutes before you are able to use the "More" button to add others to a group or export the group list.
2. The only users of the Admin console are the admins with full access, and no slowness is seen.
3. when signing in with any of the admin accounts, there is no slowness.
4. I have 2 servers running both the web interface as well as the service.
5. I do not have a DC for each domain in the same site, there are 2 or 3 domains that are cloud only and are reached open site-to-site VPN tunnels.

Answer 1

Hello,

Thank you for the provided details. It looks like the issue is about the security roles configuration. It is recommended to decrease the number of roles and assignments as much as possible. Also, it is recommended not to have a lot of group membership nesting levels. That is something that can significantly influence performance and there is no workaround.

Also, if you are not using the latest version of Adaxes, it is recommended to upgrade. For information on how to check your current version and whether your license can be used with the latest one, see https://www.adaxes.com/help/CheckUpdates.