Index: src/edu/ucsb/nceas/metacat/AuthLdap.java
===================================================================
--- src/edu/ucsb/nceas/metacat/AuthLdap.java	(revision 866)
+++ src/edu/ucsb/nceas/metacat/AuthLdap.java	(revision 867)
@@ -90,7 +90,7 @@
   public boolean authenticate(String user, String password)
                     throws ConnectException
   {
-System.out.println("ldap authenticating");
+    //System.out.println("ldap authenticating");
     String ldapUrl = this.ldapUrl;
     String ldapsUrl = this.ldapsUrl;
     String ldapBase = this.ldapBase;
@@ -105,7 +105,6 @@
         // if not found, try looking up a valid DN then auth again
         if (!authenticated) {
             identifier = getIdentifyingName(identifier,ldapUrl,ldapBase);
-            System.out.println(ldapsUrl + identifier + "," + ldapBase); 
             authenticated = ldapAuthenticate(identifier+","+ldapBase, password);
         }
 
@@ -137,6 +136,7 @@
   private boolean ldapAuthenticate(String identifier, String password)
             throws ConnectException, NamingException, NullPointerException
   {
+    double totStartTime = System.currentTimeMillis();
     boolean authenticated = false;
     if (identifier != null && !password.equals("")) {
     
@@ -145,11 +145,15 @@
         env.put(Context.INITIAL_CONTEXT_FACTORY, 
             "com.sun.jndi.ldap.LdapCtxFactory");
 
-        System.out.println("referral: " + referral);
+        //System.out.println("referral: " + referral);
         // Now that we have the dn, we can authenticate, so
         // authenticate this time when opening the DirContext
         env.put(Context.REFERRAL, "throw");
-        System.out.println("ldapsUrl: " + ldapsUrl + " ldapBase: " + ldapBase);
+        /*CB:  Note that the above env.put statement does not use the referral 
+          variable.  it is hard coded to 'throw'.  Matt: Is it ok to do this
+          only here and not in every method?
+        */
+        //System.out.println("ldapsUrl: " + ldapsUrl + " ldapBase: " + ldapBase);
         env.put(Context.PROVIDER_URL, ldapsUrl + ldapBase);
         if ( !ldapsUrl.equals(ldapUrl) ) {
           // ldap is set on default port 389
@@ -158,7 +162,7 @@
         }
         env.put(Context.SECURITY_AUTHENTICATION, "simple");
         env.put(Context.SECURITY_PRINCIPAL, identifier);
-        System.out.println("Trying DN: " + identifier);
+        //System.out.println("Trying DN: " + identifier);
         env.put(Context.SECURITY_CREDENTIALS, password);
         // If our auth credentials are invalid, an exception will be thrown
         DirContext ctx = null;
@@ -170,7 +174,6 @@
 //          StartTlsResponse tls =
 //            (StartTlsResponse)ctx.extendedOperation(new StartTlsRequest());
 //          tls.negotiate();
-
           double stopTime = System.currentTimeMillis();
           System.out.println("Connection time thru " + ldapsUrl + " was: " +
                              (stopTime-startTime)/1000 + " seconds.");
@@ -191,7 +194,7 @@
         } catch (javax.naming.InvalidNameException ine) {
             System.out.println("An invalid DN was provided!");
         } catch(javax.naming.ReferralException re) {
-	    System.out.println("referral to : " + re.getReferralInfo().toString());
+	        System.out.println("referral to : " + re.getReferralInfo().toString());
             try
             {
               /*
@@ -198,12 +201,21 @@
                Matt, I think this is right but I'm not sure...please check me to make
                sure I didn't do something wrong here.
               */
+              double refStartTime = System.currentTimeMillis();
               Context refctx = re.getReferralContext(env);
               authenticated = true;
+              refctx.close();
+              this.ldapUrl = ldapUrl;
+              this.ldapBase = ldapBase;
+              double refStopTime = System.currentTimeMillis();
+              System.out.println("total referral time: " + 
+                                (refStopTime - refStartTime)/1000 + " seconds");
             }
             catch(Exception e)
             {
-                System.out.println("Error with referral to : " + re.getReferralInfo().toString());
+                System.out.println("Error with referral to : " + 
+                                   re.getReferralInfo().toString());
+                authenticated = false;
             }
             
 	}
@@ -210,6 +222,9 @@
     } else { 
         util.debugMessage("User not found");
     }
+    double totStopTime = System.currentTimeMillis();
+    System.out.println("total ldap authentication time: " + 
+                      (totStopTime - totStartTime)/1000 + " seconds");
     return authenticated;
   }
 
@@ -234,21 +249,18 @@
     util.debugMessage("setting referrals to: " + referral);
     env.put(Context.REFERRAL, referral);
     env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);
-//    non-secure LDAP context; dn are publicly readable
-//    env.put(Context.SECURITY_PROTOCOL, "ssl");
-
+    //    non-secure LDAP context; dn are publicly readable
+    //    env.put(Context.SECURITY_PROTOCOL, "ssl");
     try {
-
+      
       // Bind to the LDAP server, in order to search for the right
       // distinguished name (dn) based on userid (uid) or common name (cn)
       DirContext ctx = new InitialDirContext(env);
-
       SearchControls ctls = new SearchControls();
       ctls.setSearchScope(SearchControls.SUBTREE_SCOPE);
-
       // Search for the user id or name using the uid, then cn and sn attributes
       // If we find a record, determine the dn for the record
-      util.debugMessage("\nStarting search phase...\n");
+      //System.out.println("Starting search phase...");
 
       String filter = "(" + user + ")";
       NamingEnumeration answer;
@@ -267,7 +279,6 @@
           return identifier;
         }
       } catch (InvalidSearchFilterException e) {}
-
       filter = "(uid=" + user + ")";
       answer = ctx.search("", filter, ctls);
       if (answer.hasMore()) {
@@ -322,8 +333,6 @@
       throw new NamingException(
       "Naming exception in AuthLdap.getIdentifyingName: " + e);
     }
-    
-//System.out.println("context: " + identifier);
     return identifier;
   }
 
@@ -609,10 +618,8 @@
     env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);
 
     try {
-
         // Create the initial directory context
         DirContext ctx = new InitialDirContext(env);
-
         // Specify the ids of the attributes to return
         String[] attrIDs = {"cn"};
 
@@ -620,7 +627,6 @@
         // Groups are objects with attribute objectclass=groupofuniquenames.
         Attributes matchAttrs = new BasicAttributes(true); // ignore case
         matchAttrs.put(new BasicAttribute("objectclass", "groupofuniquenames"));
-
         // Search for objects in the current context
         NamingEnumeration enum = ctx.search("", matchAttrs, attrIDs);
 
@@ -668,26 +674,21 @@
             "com.sun.jndi.ldap.LdapCtxFactory");
     env.put(Context.REFERRAL, referral);
     env.put(Context.PROVIDER_URL, ldapUrl + ldapBase);
-
     try {
 
         // Create the initial directory context
         DirContext ctx = new InitialDirContext(env);
-
         // Specify the ids of the attributes to return
         String[] attrIDs = {"cn"};
-
         // Specify the attributes to match.
         // Groups are objects with attribute objectclass=groupofuniquenames.
         // and have attribute uniquemember: uid=foruser,ldapbase.
         Attributes matchAttrs = new BasicAttributes(true); // ignore case
         matchAttrs.put(new BasicAttribute("objectclass", "groupofuniquenames"));
-        String dn = getIdentifyingName(foruser, ldapUrl, ldapBase);
-// System.out.println("Identifying Name: " + dn);
+        String dn = user;/*getIdentifyingName(foruser, ldapUrl, ldapBase);*/ 
         matchAttrs.put(new BasicAttribute("uniquemember",dn+","+ldapBase));
         // Search for objects in the current context
         NamingEnumeration enum = ctx.search("", matchAttrs, attrIDs);
-
         // Print the users
         Vector uvec = new Vector();
         while (enum.hasMore()) {
@@ -841,12 +842,12 @@
             Attribute attr = (Attribute)enum1.next();
             String attrValue = (String)attr.get();
             String attrName = (String)attr.getID();
- System.out.println(attrName + "=" + attrValue);
+            //System.out.println(attrName + "=" + attrValue);
             if ( enum1.hasMore() ) {
               attr = (Attribute)enum1.next();
               String refValue = (String)attr.get();
               String refName = (String)attr.getID();
- System.out.println(refName + "=" + refValue);
+              //System.out.println(refName + "=" + refValue);
               if ( ldapBase.startsWith(refName + "=" + refValue) ) {
                 trees.put(ldapBase,
                           attrValue.substring(0,attrValue.lastIndexOf("/")+1) );
@@ -854,12 +855,12 @@
                 trees.put(refName + "=" + refValue + "," + ldapBase,
                           attrValue.substring(0,attrValue.lastIndexOf("/")+1) );
               }
- System.out.println("REFERRAL:" + attrValue);
+              //System.out.println("REFERRAL:" + attrValue);
             } else if ( ldapBase.startsWith(attrName + "=" + attrValue) ) {
                 trees.put(ldapBase, ldapUrl);
             } else {              
                 trees.put(attrName + "=" + attrValue + "," + ldapBase, ldapUrl);
- System.out.println(ldapUrl + attrName + "=" + attrValue + "," + ldapBase);
+                //System.out.println(ldapUrl + attrName + "=" + attrValue + "," + ldapBase);
             }
           }
         }
@@ -873,7 +874,7 @@
       "Problem getting subtrees in AuthLdap.getSubtrees:" + e);
     }
 
-System.out.println("number of subtrees:" + trees.size());
+    //System.out.println("number of subtrees:" + trees.size());
     return trees;
   }
 
Index: src/edu/ucsb/nceas/metacat/AuthSession.java
===================================================================
--- src/edu/ucsb/nceas/metacat/AuthSession.java	(revision 866)
+++ src/edu/ucsb/nceas/metacat/AuthSession.java	(revision 867)
@@ -47,13 +47,11 @@
    * Construct an AuthSession
    */
   public AuthSession() throws Exception {
-
     // Determine our session authentication method and
     // create an instance of the auth class
     MetaCatUtil util = new MetaCatUtil();
     this.authClass = util.getOption("authclass");
     this.authService = (AuthInterface)createObject(authClass);
-    
   }
 
   /** 
@@ -65,10 +63,8 @@
    * @param password the password entered when login
    */
   public boolean authenticate(HttpServletRequest request, 
-                              String username, String password)  {
-                          
+                              String username, String password)  { 
     String message = null;
- 
     try { 
       if ( authService.authenticate(username, password) ) {
         String[] groups = authService.getGroups(username,password,username);
Index: src/edu/ucsb/nceas/metacat/MetaCatServlet.java
===================================================================
--- src/edu/ucsb/nceas/metacat/MetaCatServlet.java	(revision 866)
+++ src/edu/ucsb/nceas/metacat/MetaCatServlet.java	(revision 867)
@@ -406,9 +406,7 @@
       out.println(e.getMessage());
       return;
     }
-    
     boolean isValid = sess.authenticate(request, un, pw);
-
     // format and transform the output
     if (qformat.equals("xml")) {
       response.setContentType("text/xml");
