SAML Idp Creation taking too much time

Question

I am using "Kentor.AuthServices.dll" and "Kentor.AuthServices.Mvc.dll" in my code to allowing Single sign on with ADFS server and it is working fine but the problem is that it is taking around more than 1 min show the adfs login screen.

I have debugged the code and record the timing and found the all the code working fine but identity provider creating code is taking more than 1 min.

I am not able to understand why it is taking too much time.

I am putting my code below can anyone please help?

thanks in advance.

try
    {
    CommonUtility.LogMessage("Start at:" + DateTime.Now);
    string adfsUrl = System.Configuration.ConfigurationManager.AppSettings["ADServer"] ?? "";
    if(string.IsNullOrEmpty(adfsUrl))
    {
    CommonUtility.LogMessage("no adfs server found in config");
    return RedirectToAction("Login", "Account", string.Empty);
    }

        string requestUrlScheme = System.Configuration.ConfigurationManager.AppSettings["ADInstance"] ?? "https";
        string federationUrl = System.Configuration.ConfigurationManager.AppSettings["ADFSMetaData"] ?? "";

        CommonUtility.LogMessage("metdaDataUrl=" + federationUrl);

        string trustUrl = string.Format("{0}/adfs/services/trust", adfsUrl);

        CommonUtility.LogMessage("trustURL=" + trustUrl);

        var idps = Kentor.AuthServices.Mvc.AuthServicesController.Options.IdentityProviders.KnownIdentityProviders;
        foreach (var idpItem in idps)
        {
            CommonUtility.LogMessage("existing ENtity ID=" + idpItem.EntityId.Id);
            if (idpItem.EntityId.Id.Equals(trustUrl))
            {
                Kentor.AuthServices.Mvc.AuthServicesController.Options.IdentityProviders.Remove(idpItem.EntityId);
                CommonUtility.LogMessage("removed existing entity at:" + DateTime.Now);
            }
        }

        var spOptions = CreateSPOptions(requestUrlScheme);

        CommonUtility.LogMessage("SP option created at:" + DateTime.Now);

        Kentor.AuthServices.IdentityProvider idp = null;


        **idp = new Kentor.AuthServices.IdentityProvider(new EntityId(trustUrl), spOptions)
        {
            AllowUnsolicitedAuthnResponse = true,
            LoadMetadata = true,
            MetadataLocation = federationUrl,

        };**
        CommonUtility.LogMessage("idp added at:" + DateTime.Now);
        if (Kentor.AuthServices.Mvc.AuthServicesController.Options.SPOptions.EntityId == null)
            Kentor.AuthServices.Mvc.AuthServicesController.Options.SPOptions.EntityId = new EntityId(string.Concat(string.Format("{0}://{1}{2}", requestUrlScheme, Request.Url.Authority, Url.Content("~")), "AuthServices"));
        else
            Kentor.AuthServices.Mvc.AuthServicesController.Options.SPOptions.EntityId.Id =
                      string.Concat(string.Format("{0}://{1}{2}", requestUrlScheme, Request.Url.Authority, Url.Content("~")), "AuthServices");


        CommonUtility.LogMessage("AuthServicesURL=" + string.Concat(string.Format("{0}://{1}{2}", requestUrlScheme, Request.Url.Authority, Url.Content("~")), "AuthServices"));

        Kentor.AuthServices.Mvc.AuthServicesController.Options.SPOptions.ReturnUrl =
            new Uri(string.Concat(string.Format("{0}://{1}{2}", requestUrlScheme, Request.Url.Authority, Url.Content("~")), "SAMLAuthentication/SAMLResponse"));

        CommonUtility.LogMessage("SAMLResponseURL=" + string.Concat(string.Format("{0}://{1}{2}", requestUrlScheme, Request.Url.Authority, Url.Content("~")), "SAMLAuthentication/SAMLResponse"));


        Kentor.AuthServices.Mvc.AuthServicesController.Options.IdentityProviders.Add(idp);
        CommonUtility.LogMessage("redirect times:" + DateTime.Now);
        return RedirectToAction("SignIn", "AuthServices", new { idp = trustUrl });

    }
    catch (Exception ex)
    {
        CommonUtility.LogException(ex);
        throw ex;

    } 

Answer 1

When you use "LoadMetadata", the IdentityProvider object will load the metadata from the remote address at construction time. If I remember correctly, that's done synchronously to be able to report errors back as an exception. Does it take time (or give a timeout) to download the metadata?