SDL Web 8.5 - Unable to search and list users from "DOMAIN"

Question

We are in the process of integrating the Active Directory (AD) with CMS using MTSUser as a domain AD service account and installed the CMS using the domain MTSUser.

The size of the AD users lists 50k.

Initially, when I searched and add the users from Domain I had a timeout issue, I did increase the timeout value 1 to 5, again the same issue, again increased the timeout value to 10mins.

Now I'm getting this following below message:

Unable to list users from "Domain name"

The read operation failed, see inner exception. The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '00:10:00'. (80040356) Unable to list users from "Domain name" The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '00:10:00'.

An existing connection was forcibly closed by the remote host

Any help would be highly appreciated.

Answer 1

The time that it takes to list the users in even a moderately large domain can be sufficient to cause a timeout. This has been an ongoing issue with Tridion since the early days. You could argue that it's a Windows issue rather than a Tridion issue, but sure, Tridion tries to read the list of domain users so that it can offer a choice when adding new users. You can understand why that's a handy thing to do, assuming the list comes back quick enough.

If you want to tackle it as a Windows issue, then go to the network admins and ask them why it takes you 10 minutes to list the domain users. It can be that it's a distributed domain and it needs some local replication or caching to work well.

Most Tridion customers in this situation don't tackle it this way. Frankly - if the domain's got so many users, you probably don't want to list them all anyway. Who wants to scroll through all that?

You don't need to list a domain to add users to Tridion. In fact, you can add entirely fictitious users if you like, and sometimes it's handy to be able to add users from a domain that you're not currently attached to. If you know the name of the user, it's four lines of code to add it. So for example in Powershell you might do this:

$user = $core.GetDefaultData([ItemType]::User, $null, $null)
$user.Title = "MYDOMAIN\foobar"
$user.Description = "Foobar the Fintorious"
$user = $core.Create($testUser, (new-object ReadOptions))

Or you could just use Peter Kjaer's Powershell Module and call New-TridionUser

There are also GUI extensions that do something similar. As far as I've seen, most examples just expect you to know the name of the user, but if you wanted to list out domain users on the basis of a query, a little bit of ADSI will get you a long way.

Answer 2

Also In an alternative way to implement to Configuring Active Directory As Directory Service in SDL Web Content Manager Explorer Console.

Used to search certain parameters like Directory service name, Directory server name and Search Account DN (OU) to search specific filters to limit your search query.

SDL Web8.5 documentation: http://docs.sdl.com/LiveContent/content/en-US/SDL%20Web-v5/GUID-B054C935-D163-4448-870E-0BE8C96DC099#addHistory=true&filename=GUID-97E4D490-2D32-46EE-ADDE-E30513A1C3D9.xml&docid=GUID-CE2C4904-5565-4611-B7B6-222E1EDCEA44&inner_id=&tid=&query=&scope=&resource=&toc=false&eventType=lcContent.loadDocGUID-CE2C4904-5565-4611-B7B6-222E1EDCEA44

Really works awesome and super fast.