Not sure how the Foreman lookup is performed, but I can do a ldapsearch lookup listing all groups for a specific user:

$ ldapsearch <options> -b OU=Groups,DC=ad,DC=example,DC=com "(&(objectClass=group)(member=CN=<user>,OU=People,DC=ad,DC=example,DC=com))" 

This query takes ~0.031s.

Looking at the debug logs, Foreman seems to first lookup the groups i am a member of and then proceeds to make lookups of every member of all those groups, resulting in about 1500 lookups. Is there really a need for looking up every user instead of just looking up the groups? (with ldapsearch, first looking up the users groups and then looking up each of those groups takes ~1.5s).

Did you perform this search from Foreman server itself? Including the same hostname? Could be as simple as a slow DNS query.

Anyway, go to setting.yaml and enable LDAP logger, enable DEBUG level, restart the app and then you should see all the LDAP queries if I am not mistaken.

Yes, the ldapsearch was performed on the Foreman server, against the same LDAP host.

I've already added the ldap debugger, that's showing that Foreman does ~1500 lookups, one for each individual member in all my groups. With all those lookups it's not surprising that the sync takes a long time, but is it necessary to lookup every user in the groups? Shouldn't it be enough to lookup the user logging in and the groups?

Well, that does not sounds right indeed. Ondro, is this expected? #25795

This is still really slow for me. But, I am in 740 different AD groups. (Maybe that's quite common in large organisations)

Alex, please create a new issue with link to this one and provide more details. Was this a regression?

We would appreciate more debugging stuff, we do not necessary test against LDAP with many groups, but if we are able to identify what exactly is slow we would love to help.