Encountered the following behavior in Keycloak v.26.0.5:

Configured User Federation via LDAPS with the following settings:

Import Users: On
Edit Mode: Read_Only
Search scope: Subtree
Pagination: On
Cache policy: MAX_LifeSPAN (3,600,000 ms)
Created an ldap-role-mapper that imports MSAD groups into Realm Roles with the following configuration:

Mode: READ_ONLY
User Roles Retrieve Strategy: LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY

Issue:
During every user authentication, a full recursive query for all roles is executed. The already synchronized list of roles is not being reused. This causes critical delays during the authorization process.

Question:
Is this the expected behavior? Or should the synchronization of MSAD groups into Realm Roles occur only during scheduled synchronization?