DirectoryServices.AccountManagement - group membership checking efficiency

Question

We have a group in Active Directory with over 70k user accounts. I need to check whether someone is a member of that group. The code is going to run in a web app with a high volume of concurrent users. I'd prefer to stick to System.DirectoryServices.AccountManagement if possible to reduce the amount of code that's written for this app.

There appear to be 2 general approaches to checking whether someone is a member:

1. Use UserPrincipal.IsMemberOf() to get a boolean value indicating membership
2. Use UserPrincipal.GetGroups() to get a list of group memberships that I can manually check

I want to avoid the enumerating 70k users to check whether someone is in a group, so option 2 seems to be more efficient on face value. When I go into work I can do some tests against both methods but I wanted to get some info on what these methods are really doing under the covers. Am I on the right track here in my thinking?

One last point about the library I'm using. Can I get better performance if I drop out of System.DirectoryServices.AccountManagement altogether and write my own LDAP queries?

Answer 1

Well, one thing you might want to consider to make things more efficient is based on the fact that group membership really is managed by the group that has a list of users (and groups) that are its members. The "memberOf" on the user is really a calculated "back link" - see this excellent article for more information.

So if you need to check for membership in one or two groups, it might be a whole lot easier to just walk up to those groups and ask them for their members list, and cache those. When evaluating users, you'd only have to check whether or not their DN shows up in one of the group member lists, without hitting AD over and over again.

You'd be doing something like:

GroupPrincipal myGroup = Group.FindByIdentity(context, "myGroupName");

var members = myGroup.GetMembers();

With this, you should be able to get better performance thanks to caching of the group membership info. Try it!