How to speed up logons to Webservice realms

SecureAuth IdP Version Affected:  All

Description: 

How Webservice logons can be improved in efficiency with multi-data stores by allowing users to log on against a specific lookup realm by using their down-level (DOMAIN\Username) logon name.

Cause: 

When the Webservice is used with multiple realms there is a delay as each realm is searched consecutively.  When many realms are in use, the delay can become quite pronounced.  It's possible to shortcut Webservice logons so it directly searches the relevant realm for the user.  

Resolution: 

In the Multi-Datastore Membership Configuration on the Data tab of the Webservice realm, click "Add Realm from Another Server"

 

Enter the realm Name or URL followed by a pipe character "|" and then a realm identifier of your own choice.  For simplicity this can be the AD domain name if desired, e.g.:

 

For local realms:

SecureAuth1|DOMAIN

 

Or for remote realms:

https://idp.domain.com/secureauth1|DOMAIN

 

 

 

Now when the user logs on they can specify the realm/domain that the Webservice should use by typing the realm identifier followed by a backslash then the username, e.g.:

DOMAIN\username

 

Note:

To also assert the down-level logon name rather than just the plain logon name see this article:

https://support.secureauth.com/hc/en-us/articles/360027934891-How-to-send-DOMAIN-Username-in-an-assertion

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products