UI Slow Performance After SSO/OIDC Configuration Change Involving Group Memberships – DataHub Customer Support Portal

Area: UI Issues

Sub-Area: SSO/OIDC Configuration — Performance Impact

Issue

After modifying OIDC/SSO advanced settings — specifically changing the User Name Claim, User Name Claim Regex, and Scope to include groups — users may experience significant UI slowness across all pages of the DataHub application. This occurs because the updated SSO configuration causes users to authenticate as a different CorpUser identity than before (for example, logging in as username instead of username@example.com). If the new identity is a member of a large number of groups (e.g., groups synced via LDAP ingestion), the policy evaluation engine and the getMe GraphQL query — which fetches group memberships and platform privileges on every page load — can become a bottleneck, causing application-wide latency. A related bug in the proposals logic involving large numbers of group memberships was also identified as a contributing root cause.

Error Messages

Slow or unresponsive page loads across all DataHub UI pages
Data product pages failing to load or rendering an error state after SSO re-authentication
getMe GraphQL query taking several seconds to complete on every page navigation

You Might Be Asking

Why did my DataHub UI become slow after I changed the OIDC User Name Claim or added groups to the SSO scope?
Why does clearing cookies and re-authenticating not resolve the slowness?
Is there a performance issue when a user is a member of many LDAP-synced groups?
Which DataHub version contains the fix for group-membership-related UI performance degradation?
Why does reverting my SSO configuration restore normal performance?

Solution

Understand the root cause.
When the OIDC User Name Claim is changed (for example, from preferred_username to email with a regex that strips the domain), users log in as a different CorpUser identity. If that new identity has been assigned to a large number of groups via LDAP ingestion, every page load triggers an expensive getMe query and policy evaluation pass that enumerates all group memberships. This is the primary source of latency.

Identify the affected query.

Open your browser's developer tools (right-click → Inspect → Network tab) and look for a slow getMe GraphQL request. A representative minimal version of this query is shown below:

query getMe {
  me {
    corpUser {
      username
      groups: relationships(
        input: {
          types: ["IsMemberOfGroup", "IsMemberOfNativeGroup"],
          direction: OUTGOING,
          start: 0,
          count: 50
        }
      ) {
        relationships {
          entity {
            ... on CorpGroup {
              urn
              name
            }
          }
        }
      }
    }
    platformPrivileges {
      viewAnalytics
      managePolicies
      # ... additional privilege fields
    }
  }
}

If this query appears on every page navigation and takes several seconds, the issue described in this article is likely the cause.

Short-term workaround: revert SSO configuration.
If upgrading immediately is not possible, reverting to the previous SSO settings will restore normal performance. The following configuration is known to avoid the performance issue:
```
User Name Claim:       preferred_username
User Name Claim Regex: (.*)
Groups Claim:          groups
Scope:                 openid email profile
```
Note that reverting will change user identities back to the original CorpUser URN format (e.g., urn:li:corpUser:username@example.com instead of urn:li:corpUser:username). Evaluate whether this impacts your ingestion-to-identity alignment before reverting in production.
Permanent fix: upgrade to DataHub version 2.1.2 or later.
A bug in the proposals logic related to large group memberships was identified as a contributing root cause of the slowness. This bug was resolved in DataHub v2.1.2. Upgrading to v2.1.2 or any later release allows the preferred SSO configuration (with group claims and username-based URNs) to function without the associated performance penalty.

After upgrading, validate in a staging environment first:
1. Apply your desired OIDC settings in the staging environment.
2. Sign out, clear browser cookies, and re-authenticate via SSO.
3. Navigate through several pages and confirm getMe query latency has returned to normal using the browser Network tab.
4. Verify the correct CorpUser identity is resolved:
```
query {
  me {
    corpUser {
      username
    }
  }
}
```
  Expected response with corrected SSO settings:
```
{
  "data": {
    "me": {
      "corpUser": {
        "username": "<your-preferred-username>"
      }
    }
  }
}
```
5. Once validated in staging, promote the upgrade and SSO configuration change to production.
Collect a HAR file if escalating.
If slowness persists after upgrading, capture a HAR file to share with DataHub Support. In Chrome or Edge: open DevTools → Network tab → reproduce the slow page load → click the download (⬇) icon to export the HAR file. This file captures all network traffic and timing information needed for backend log correlation.

Additional Notes

This issue is specifically triggered by a combination of two factors: (1) an OIDC configuration that results in users authenticating under a new CorpUser URN, and (2) the new identity being a member of a large number of groups (for example, 50 or more groups synced via LDAP). Environments where users belong to few groups may not observe this degradation even with the same SSO settings. Clearing browser cookies alone does not resolve the issue — the fix requires either reverting the SSO configuration or upgrading to v2.1.2+. DataHub Cloud customers should contact support to coordinate the upgrade and any backend monitoring needed during the transition. The getMe query runs on every page load and fetches up to 50 group memberships and all platform privileges per user, making it sensitive to policy engine performance under high group-membership counts.

Issue

Error Messages

You Might Be Asking

Solution

Additional Notes

Related Documentation