MSAD users unable to log in to Essbase but native user can

short description of the error: MSAD users fail to login to Essbase and get no access error message. It's only happening in Essbase, all the other application are fine and also native users can login. After restart Essbase services, it's working fine again,but couple of hours later it fails again. 

---

Root cause: shared service failed to cache the user groups because of an unfiltered user group setting in shred service and it gets back to many records (all groups) from the LDAP server when it's trying to cache it, it throws out of memory java error. 

---

logs to check: 
AnalyticProviderServices0.log
SharedServices_SecurityClient.log
FoundationServices0.log
console_EssbaseAgent_AGENT.log

---

Find the error:
1. check the SharedServices_SecurityClient.log and if there is a suspiciously huge number of group response from the MSAD server (in this case it was 27000 record) and then there is a "Failed to unify group cache" error ([SRC_CLASS: com.hyperion.css.cache.CacheThread] [SRC_METHOD: buildCache] Failed to unify group cache.) then this is the problem. 

2. check the shared service if the user group is supporting for MSAD and see if there is any group filter: 

---

Resolution: 
1. Temporary fix: Give more heap memory to the ESS_CSS_JVM in the OPMN.XML (Xms and Xmx) options. This can be just a workaround while the user groups will be filtered. 
2. Permanent fix: Put the lowest possible user group filter in shared service. This will optimise the search. MSAD admin can help find the suitable user group filter.