4

We are using LDAP authentication. We have upgraded one of the server from Tridion 2011 sp1 to Tridion 2013 sp1.

Before upgrade, search for particular user for adding the user was working fine however after the upgrade to 2013 sp1, the search for the user (new user -> directory service -> select domain -> enter user id and click search) is failing with below error:

(80040356) Unable to list users from Error occurred while searching in LDAP subtree 'OU=Accounts, DC=ABC,DC=com' with filter '(sAMAccountName=*)'. The size limit was exceeded

Also, noticed that even though user is specified for search still all the users are being retrieved as filter is sAMAccountName=* which seems to be incorrect.

Please suggest what can be done to resolve the issue.

  • Are you working with a particularly large directory? – Chris Morgan Jul 2 '14 at 23:23
  • Yes, however my question will be it is working with Tridion 2011 sp1 then why not with 2013 sp1? – Hiren Kaku Jul 2 '14 at 23:25
  • Is this upgraded machine, or new machine with fresh 2013 install? – Chris Morgan Jul 2 '14 at 23:31
  • Upgraded machine. – Hiren Kaku Jul 2 '14 at 23:32
5

If memory serves me correctly, LDAP has a limit set for the maximum resultset available to a single query.

You could ask your LDAP administrator to increase the maxpagesize on your LDAP server (1000 by default).

However, this does not explain why it worked in 2011.

Alternatively, you could install the AddUser power tool available to download as part of the SDL Tridion Power Tools Suite here: https://docs.google.com/a/building-blocks.com/file/d/0B-59cCi_8LTZVE1sVlFOeFR4b2M/edit

Please note, the following fix: https://code.google.com/p/tridion-2011-power-tools/issues/detail?id=53

4

I experienced the same problem after 2013 SP1 upgrade. Tridion CS sent me NewUserExt - custom extension that overrides (at some sort) default new user actions. I would advise you to contact CS asking them for the extension.

1

This looks like you are hitting a limit on the LDAP server rather than in Tridion. You could confirm this by checking the logs of the LDAP server. (If you can say what kind of LDAP server you are using, that will give better context for the error message.) Another way to confirm it would be to execute a similar query directly using LDP or another suitable utility and seeing if you get the same result.

It's hard to see why upgrading Tridion would have this effect, however it's quite normal for LDAP servers to have quotas on the size of result sets they will return. It's also very common for these to be much more restrictive when the query is executed anonymously. (This is to prevent denial-of-service attacks.)

So if somehow your configuration got mangled during the upgrade, you might not be making the LDAP queries with the correct credentials. Double check your Search Account DN in the config. If it's empty, you'll get an anonymous bind, and your searches will probably succeed unless they hit a quota. To debug this properly, you need to get access to the LDAP server logs, which will show the bind occurring and whether it was successful.

Also consider whether the amount of data in the LDAP server has changed, and whether the amount of directory group mappings has changed.

  • 1
    Hey Dom, we did a fresh install of 2013SP1 and configured identical LDAP settings in the Tridion CM Snap-in as the legacy 2011 SP1 machine. Now, side by side 2011 SP1 works fine, but 2013 SP1 has the "exceeded limit" error - identical to what was reported in the question. So I am skeptical about the second-last paragraph in your answer regarding mangled configuration. – Nickoli Roussakov Nov 1 '14 at 19:46
  • I can see that Nick. It's possible that the new version has a bug, but in any case, the first step is to analyse the LDAP server logs to see what binds and queries are being made. – Dominic Cronin Nov 3 '14 at 20:21
  • 1
    If you look at the error closely, even though you are searching for some particular account still the search is done as sAMAccountName=* which is retrieving all users. Retrieving all users will surely fail with size limit. – Hiren Kaku Nov 4 '14 at 17:03
  • Hiren - that depends on the LDAP server, and the size of the subtree. It's perfectly possible to configure the server to return all the users without hitting a limit. As I said though, to prevent DOS attacks, the size of the result set is usually more restrictive for an anonymous user. – Dominic Cronin Nov 6 '14 at 10:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.