Logging into the RSA Security Analytics UI has a large delay when using external authentication with Active Directory

Issue

It takes up to 5 minutes each time a user tries to log in with an account using external authentication with Active Directory.
Once the user is able to login, the account functions normally without any unexpected delays.

The  admin user can log in without any delay and the account also functions normally.

Cause

This issue occurs when the forest in the Active Directory environment has older domain controllers that are no longer available.
When the Security Analytics server asks for the user and group, the user must wait for the lookup to complete.

Resolution

This issue is related to DNS and listing servers that are no longer available for domain access.
In order to resolve the issue with Security Analytics, use  tcpdump to monitor the domain requests when a login attempt is made, and make any necessary changes to the Active Directory forest.

Product Details

RSA Product Set: Security Analytics
RSA Product/Service Type: Security Analytics UI, Security Analytics Server
RSA Version/Condition: 10.4.x
Platform: CentOS
Platform (Other): Microsoft Active Directory
O/S Version: EL6

Approval Reviewer Queue

ASOC Approval Group