# Identity Awareness AD user authentication takes a long time

## Product
Identity Awareness

## Version
R81.20, R82, R82.10

## Last Modified
2026-07-23

## Symptoms

- AD users from different identity sources, such as Identity Collector and IA Web API, authenticate successfully, but the authentication process takes a long time.
- The PDPD process on the Security Gateway shows high CPU usage (over 70%). When you run the pdp commands, such as `pdp debug stat`, it can return this output:

> `daemon did not respond or not running`

- The CpAuth process shows high CPU usage with the `top -b -n 1 -H -p <pdpd_process_ID>` command. Example output:

> `   PID USER      PR  NI    VIRT    RES    SHR S %CPU %MEM     TIME+  P COMMAND`  
    > `164524 admin     20   0 1992012 1.528g  41724 R 93.3  1.2  27292:50 20 CpAuth Manager`  
    > `25623 admin     20   0 1636852 1.195g  42576 R 86.7  1.0   2528:58  9 CpAuth Manager`

- The `netstat` command output indicates a high Recv-Q value between PDPD to PEPD. Example output:

> `Proto Recv-Q Send-Q Local Address        Foreign Address       State    PID/Program name`  
    > `tcp  3789700   0 127.0.0.1:35743       127.0.0.1:15105       ESTABLISHED 109949/pdpd`

- The output of the `perf record -p <pdpd process ID> -g` command indicates high CPU usage in the **AddNonMemberGroupToUser** function. Example output:

> `37.67%     0.00%  CpAuth Manager   libc-2.17.so                    [.] __clone`  
    > `... ...`  
    > `    |--12.60%--CLdapExtGroupHelpers::AddNonMemberGroupToUser`

## Solution

This problem was fixed. The fix is included in:

- [Jumbo Hotfix Accumulator for R82.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm) starting from Take 19
- [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 118
- [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 158

If you choose not to upgrade, Check Point can supply a **Hotfix**. [Contact Check Point Support](https://www.checkpoint.com/support-services/.contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**

Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

After installing the hotfix, apply these configuration changes:

1. Connect to the PDP Security Gateway with SSH and log in to expert mode.
2. If the environment is VSX, enter the relevant VS Security Gateway and run:
   
   `vsenv <VS Security Gateway ID>`
3. Back up the original configuration:
   
   ```
   [Expert@security gateway]# cp -v $CPDIR/tmp/.CPprofile.sh{,.BAK}
   ```
4. Use the VI editor to open the file for editing:
   
   ```
       vi $CPDIR/tmp/.CPprofile.sh
   ```
5. Add the following line at the end of the file:
   
   ```
   export DISABLE_USER_UPDATE=1
   ```
6. Save the file and exit the VI editor.
7. Plan a maintenance window and reboot the Security Gateway to apply the change.
8. Repeat these steps on each VS Security Gateway or cluster member, if applicable.

#### NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

## Article Properties

Access Level: General
Status: Approved by TAC
Date Created: 2026-03-24
Last Modified: 2026-07-23