sk183748 - Identity Awareness AD user authentication takes a long time

Identity Awareness AD user authentication takes a long time

Product

Identity Awareness

Version

R81.20, R82, R82.10

Last Modified

2026-07-23

Symptoms

AD users from different identity sources, such as Identity Collector and IA Web API, authenticate successfully, but the authentication process takes a long time.
The PDPD process on the Security Gateway shows high CPU usage (over 70%). When you run the pdp commands, such as pdp debug stat, it can return this output:

daemon did not respond or not running

The CpAuth process shows high CPU usage with the top -b -n 1 -H -p <pdpd_process_ID> command. Example output:

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ P COMMAND
164524 admin 20 0 1992012 1.528g 41724 R 93.3 1.2 27292:50 20 CpAuth Manager
25623 admin 20 0 1636852 1.195g 42576 R 86.7 1.0 2528:58 9 CpAuth Manager

The netstat command output indicates a high Recv-Q value between PDPD to PEPD. Example output:

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 3789700 0 127.0.0.1:35743 127.0.0.1:15105 ESTABLISHED 109949/pdpd

The output of the perf record -p <pdpd process ID> -g command indicates high CPU usage in the AddNonMemberGroupToUser function. Example output:

37.67% 0.00% CpAuth Manager libc-2.17.so [.] __clone
... ...
|--12.60%--CLdapExtGroupHelpers::AddNonMemberGroupToUser

Solution

This problem was fixed. The fix is included in:

Jumbo Hotfix Accumulator for R82.10 starting from Take 19
Jumbo Hotfix Accumulator for R82 starting from Take 118
Jumbo Hotfix Accumulator for R81.20 starting from Take 158

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

After installing the hotfix, apply these configuration changes:

Connect to the PDP Security Gateway with SSH and log in to expert mode.
If the environment is VSX, enter the relevant VS Security Gateway and run:

vsenv <VS Security Gateway ID>

Back up the original configuration:

[Expert@security gateway]# cp -v $CPDIR/tmp/.CPprofile.sh{,.BAK}

Use the VI editor to open the file for editing:
```
    vi $CPDIR/tmp/.CPprofile.sh
```
Add the following line at the end of the file:
```
export DISABLE_USER_UPDATE=1
```
Save the file and exit the VI editor.
Plan a maintenance window and reboot the Security Gateway to apply the change.
Repeat these steps on each VS Security Gateway or cluster member, if applicable.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access Level: General Status: Approved by TAC Date Created: 2026-03-24 Last Modified: 2026-07-23