Uploaded image for project: 'LDAP'
  1. LDAP
  2. LDAP-59

Active Directory groups with more than 1500 members don't properly synchronize with XWiki Groups

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 9.3
    • Component/s: Authenticator
    • Labels:
      None
    • Difficulty:
      Unknown
    • Documentation:
      N/A
    • Documentation in Release Notes:
      N/A
    • Similar issues:

      Description

      The issue reproduces for a LDAP group with 1716 members which didn't properly synchronize with the XWiki Group.

      As Denis Gervalle investigated:

      AD has a limitation on the number of attribute values returned by a query, and require that a range value is used for attribute having more than 1500 values.
      XWiki does not seems to support properly group of that size, this is a limitation of the product.
      The retrieval of group members is done with a single query, similar to:

      -b "<group dn>" '' objectClass uniquemember memberuid member sAMAccountName
      

      and to retrieve properly member of a large group, the following would be needed:

      -b "<group dn>" '' objectClass uniquemember memberuid 'member;range=1500-2000' sAMAccountName
      

      Using ldapsearch, it automatically limit the range to 0-1499, but without any range, apparently no value of attribute member is returned.
      As a result, the group is seen empty.

        Attachments

          Activity

            People

            • Assignee:
              tmortagne Thomas Mortagne
              Reporter:
              ibalan Iulia Balan
            • Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:
                Date of First Response: