Slowness while login and/or password reset/Unlock Account

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Which IIQ version are you inquiring about?

Version 8.3

Share all details related to your problem, including any error messages you may have received.

We’re currently experiencing performance issues within the SailPoint IdentityIQ module. This is causing delays when loading certain pages when accessing specific functionalities.
1- When a user tries to access the sailpoint URL and provides the credentials, by clicking submit, it takes an average of 43 seconds to load and access the HomePage.
2- When accessing the “Forget Password” or “Unlock Password” functionality on the login page, it takes an average of 41 seconds to load the page to provide the updated password.
3- Once the “Forget Password” functionality is available, an OTP is generated. Once the OTP values and the passwords are provided, and on clicking Submit it takes around the same amount of time(average of 42 seconds) to validate and update the result for the same.

Any thoughts or suggestions on how can we fix that?

1 Like
2

@MuhammadMustafa , does you have any provisioning or requests being triggered on the UI servers?

Login, password reset or unlock are foregrounds.therefore it appears that the server is waiting the thread to be pickup and executed.
Also communications with the AD could also cause slowliness.

Can you provide more info about the architecture.

1 Like
3

Hi @MuhammadMustafa

It would be possible provide more information about your architecture, use of load balancer, what application server you are using, etc…
From other side, can you provide more details about your authentication method. it is through Active Directory?

Finally, please provide any log to check the error that you are facing.

1 Like
4

Hey @ipobeidi thanks for your response,

  • Does you have any provisioning or requests being triggered on the UI servers?
    nope, it’s only 1 server not a big Env at all, also we are leveraging the Password Rest Functionalities only for this deployment.

  • Login, password reset or unlock are foregrounds.therefore it appears that the server is waiting the thread to be pickup and executed.
    Exaclty, but unfortunately it’s not the case.

  • Also communications with the AD could also cause slowliness.
    I’m suspecting that as of now, but don’t know what might cause a delay :), especially when my colleague checked the test connection and it’s taking about/more 1.3 mins

  • Can you provide more info about the architecture.
    Simply 1 server, no LB, PTA authentication via AD, PWI & DPR (for password reset), integration with a private/custom SMS gateway.
    So it’s a simple one :slight_smile:

We are investigating now with SailPoint Support as well.

1 Like
5

Hey @ismaelmoreno1

It would be possible to provide more information about your architecture, use of load balancer, what application server you are using, etc…

Simply 1 server, no LB, PTA authentication via AD, PWI & DPR (for password reset), integration with a private/custom SMS gateway, tomcat 9.0.85
So it’s a simple one :slight_smile:

From other side, can you provide more details about your authentication method. it is through Active Directory?

Yup AD PTA

Finally, please provide any log to check the error that you are facing.
I will try to raise the logs and see, will keep you posted :wink:

1 Like
6

Do you have multiple custom quicklink in your env ?

1 Like
7

Hey thanks for the responses.
How many threards does this server have? Also could you enable debug on the IQservice and log in and se how long it take to send the response back?

best!

1 Like
8

Hi @vishal_kejriwal1 nope, we don’t have

1 Like
9

we have seen this issue were we have the custom and complex membership rule for some of the quicklink ( custom / ootb) . When you click on any of the quick-link pretty much system will try to execute all the quick-link membership rule and can take more time .

2 Likes
10

It looks like you have multiple authentication (login) options enabled and the 1st one is giving a timeout.

I have seen the same when Pass-Through Authentication was enabled to an AD, where the AD server was not responding. After a timeout IIQ switched to Internal IdentityIQ Authentication.

You might also have MFA enabled without a proper configuration.

Can you check which Login options are enabled and try to disable 1-by-1 to see if the login (and others) are fast again (Gear->General Settings->Login Configuration).

Please take a look at the following link for more information:
https://community.sailpoint.com/t5/Technical-White-Papers/IdentityIQ-Login-Configuration/ta-p/76904

– Remold

3 Likes
11

You can also check the variable on the system configuration to tweak the login duration:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Configuration PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<Configuration created="1608312632666" id="7f00000176761712817676e7355a00e4" modified="1712689788409" name="SystemConfiguration">
  <Attributes>
    <Map>
      <entry key="AccountGroupPermissions.challengeGenerationEmailTemplate" value="Account Group Challenge Creation Notification"/>
      **<entry key="LoginAuthDurationMillis" value="3600000"/>**
      <entry key="ProtectedUserLockout" value="true"/>

or also change the Login Error Style to see what IIQ is receiving it .

1 Like
12

Hi @vishal_kejriwal1 after checking, yes our team created a simple quicklink however they removed it now and the issue still persists, unfortunately.

Thanks a lot for your note and suggestion :slight_smile:

1 Like
13

Hi @Remold we don’t have multiple auth options/methods our team double-checked that.

Thanks a lot for your note nad suggestion :).

1 Like
14

Hi @ipobeidi I will check this one and let you know.
However, the support team (SailPoint support) saying most probably it’s a network/connection issue.

Will keep you all posted here as we are already opening a case with SailPoint support

2 Likes
15

Any ootb quicklink were you modified visibility based on complex membership rule ?

1 Like
17

Hi @vishal_kejriwal1 Nope, our team confirmed that however, I will double-check again by myself on Monday.

1 Like
18

Did you try checking with db team that which query is taking more time ?

1 Like
19

Hi @vishal_kejriwal1 yes we checked but it’s working normally…

Thanks a lot for your support ,I got a reply from SailPoint and it’s resolved, will add it now to share with other guys whom supported me here in the post/topic

1 Like
20

IdentityIQ Performance Issue

Description

  • There was an overall delay in loading identityIQ Password Reset pages – delay of 43 secs.
  • The Overall test connection to AD application delay was of 1.31 mins. For password reset via SMS there was a delay of 43 secs.
  • To confirm, we also monitored the network latency to see if there was traffic but with no issues there.
  • We also raised the log levels and found a delay of 43 seconds was coming up while creating runSpace for implementing the operations from SailPoint IdentityIQ.

Solution

After providing IP in Domain Configuration (In Servers settings of AD Application definition), the Test connection was quick and the reset password also got executed successfully within 5 seconds.

Added all IPs of all DCs under the Servers list and performed use cases to validate the results and all the password resets and delays in loading the page were resolved.

Explanation for the solution

It is important to provide the IP addresses of all the domain controllers in the server list of forest and domain configurations.

*** What happens when this is not configured?***

  • When you are not provided with the list of servers under the configuration, IQService runs a command in PowerShell that executes a statement and fetches the available DC.
  • This PowerShell script run takes delay causing the test connection and update on password reset to take longer time.
  • On the other hand, when you provide with the list of IPs of the domain controllers under the configuration, IQService, since already knowing the list of IP addresses, IQService will randomly go to one DC and fetch the details.
  • Hence, there is no delay since IQService is not going to PowerShell and running the script run.
3 Likes
21

Thanks for the explanation!

This really helps troubleshooting similar issues and I learned something (IQService performing test connection) :slight_smile:

– Remold

2 Likes