[JENKINS-28858] More aggressive group membership caching

In too many organizations, AD is too large and login takes too long. The bulk of this time is spent on looking up group memberships.

We should do more aggressive caching of the memberships to cut down this cost. In particular, we should cache the map from DN of group/user to its memberOf attributes.

We can have a long cache retention value (say 24hrs?) to improve the out of the box experience.

Where this hurts is when a group membership changes. Possible mitigations are:

• Let the user login immediately, but uses that loging credential in the background to recompute membership asynchronously. When the result is available, update the group list after the fact.


• Expose a method for Groovy script to purge the cache


• Have a system property to control the cache timeout

---
Originally reported by kohsuke, imported from: More aggressive group membership caching

• status: Open
  
• priority: Major
  
• component(s): active-directory-plugin
  
• resolution: Unresolved
  
• votes: 1
  
• watchers: 2
  
• imported: 2025-12-07
  

In too many organizations, AD is too large and login takes too long. The bulk of this time is spent on looking up group memberships.


We should do more aggressive caching of the memberships to cut down this cost. In particular, we should cache the map from DN of group/user to its memberOf attributes.


We can have a long cache retention value (say 24hrs?) to improve the out of the box experience.


Where this hurts is when a group membership changes. Possible mitigations are:




	
Let the user login immediately, but uses that loging credential in the background to recompute membership asynchronously. When the result is available, update the group list after the fact.

	
Expose a method for Groovy script to purge the cache

	
Have a system property to control the cache timeout

No files, tests, or entry points are named. Start by tracing the active-directory-plugin's group membership lookup and determine how DN-to-memberOf results could be cached. Define the retention and membership-change behavior, including the proposed 24-hour timeout and possible purge, asynchronous refresh, or system-property controls.

Written by the indexing model from the issue text.