WSSecurityTokenSerializer ReadToken method performance

Question

I have a Dispatch MessageInspector which is deserializing a SAML Token contained in the SOAP message header.

To do the deserialization I am using a variation of the following code:

List<SecurityToken> tokens = new List<SecurityToken>();

tokens.Add(new X509SecurityToken(CertificateUtility.GetCertificate()));

SecurityTokenResolver outOfBandTokenResolver = SecurityTokenResolver.CreateDefaultSecurityTokenResolver(new ReadOnlyCollection<SecurityToken>(tokens), true);

SecurityToken token = WSSecurityTokenSerializer.DefaultInstance.ReadToken(xr, outOfBandTokenResolver);

The problem I am seeing is that the performance of the ReadToken call varies depending on the account that is running the windows service (in which the WCF service is hosted).

If the service is running as a windows domain account the elapsed time for the ReadToken call is virtually zero. When running as a local machine account the call takes between 200 and 1000 milliseconds.

Can anyone shed any light on what is going on here and why the account running this bit of code makes a difference as to its performance?

Thanks,

Martin

Answer 1

When the service is running under a local account that there is considerably more activity taking place, examples of this are :

• Accessing and using C:\WINDOWS\system32\certcli.dll

• Accessing and using C:\WINDOWS\system32\atl.dll

• Attempting to access registry keys e.g. HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration

None of this extra activity appears to occur when running under a domain account.

A quick search on the internet for "certcli.dll domain user" brings up microsoft knowledge base article 948080 which sounds similar.

Unsure how to resolve this as ultimately a .Net method is being called (WSSecurityTokenSerializer.ReadToken) where you have little to no control over the internals.

This appears to also describe the same problem :

http://groups.google.com/group/microsoft.public.biztalk.general/browse_thread/thread/402a159810661bf6?pli=1