Very Slow Sharepoint (Authentication Problem? - Getting 401 errors on images and styles)

Question

I'm currently using Team Foundation Server and WSS 3.0 as the Team Portal. After the installation and configuring, I noticed the application was very slow sometimes, taking minutes to load a page. Then I googled it and found n solutions, none solved my problem.

Using Firebug I noticed I was getting a lot of 401 errors, mostly in _layouts and _themes folders.

Error image: http://i.stack.imgur.com/SmurI.jpg

Authentication method is NTLM

Any clue on what's happening? The page loads, it just takes forever before showing up.

EDIT: Here's fiddler statistics:

Request Count: 161 Bytes Sent: 144.851 (headers:133249; body:11602) Bytes Received: 400.222 (headers:69769; body:330453)

ACTUAL PERFORMANCE

Requests started at: 09:47:55.449 Responses completed at: 09:50:03.311 Aggregate Session time: 00:03:11.542 Sequence (clock) time: 00:02:07.8627850 TCP/IP Connect time: 239ms

RESPONSE CODES

HTTP/401: 84 HTTP/200: 74 HTTP/302: 2 HTTP/404: 1

RESPONSE BYTES (by Content-Type)

application/x-javascript: 218.048 ~headers~: 69.769 text/html: 37.837 image/gif: 31.467 text/css: 27.506 image/png: 10.133 image/jpeg: 3.937 text/javascript: 1.007 text/xml: 518

Solution

We have had exactly this problem with a sharepoint site.

The root cause is the way that NTLM works. The NTLM handshake is a 401.2 401.1 followed by a 200. Allways 3 requests for each file.

For each request, the web server will send a request to the AD server. The problem is that by default there is only 2 connections to the AD server. So the request get backed up and retried.

There are two things that you can do:

• Make sure that you are caching the gif files (then you will not have to get them all the time)
• Switch to Kerberos

Edit

For setting up Kerberos have a look at this blog post http://blogs.msdn.com/b/martinkearn/archive/2007/04/23/configuring-kerberos-for-sharepoint-2007-part-1-base-configuration-for-sharepoint.aspx

Comments

[Conrad Clark]

Thanks for the response! I'm trying to switch to Kerberos but I don't know how it's supposed to work. The sharepoint site is hosted in a server but the databases are stored in another. I'm guessing I need to set the SPN in the host server and specify the service account, but i'm getting "RPC Server Unavailable".

[Conrad Clark]

Yes, at first I thought the certificate revocation list was the problem. But noticed no changes at all.

[Conrad Clark]

I think it can't be a network issue, because when I access the page from a browser on the server itself, I get the same slowdown problems. Could the RPC Server Unavailable problem be caused by closed ports which are required for kerberos ?