Tridion 2013 sp1 upgrade - New user add not working

Question

We are using LDAP authentication. We have upgraded one of the server from Tridion 2011 sp1 to Tridion 2013 sp1.

Before upgrade, search for particular user for adding the user was working fine however after the upgrade to 2013 sp1, the search for the user (new user -> directory service -> select domain -> enter user id and click search) is failing with below error:

(80040356) Unable to list users from Error occurred while searching in LDAP subtree 'OU=Accounts, DC=ABC,DC=com' with filter '(sAMAccountName=*)'. The size limit was exceeded

Also, noticed that even though user is specified for search still all the users are being retrieved as filter is sAMAccountName=* which seems to be incorrect.

Please suggest what can be done to resolve the issue.

Answer 1

If memory serves me correctly, LDAP has a limit set for the maximum resultset available to a single query.

You could ask your LDAP administrator to increase the maxpagesize on your LDAP server (1000 by default).

However, this does not explain why it worked in 2011.

Alternatively, you could install the AddUser power tool available to download as part of the SDL Tridion Power Tools Suite here: https://docs.google.com/a/building-blocks.com/file/d/0B-59cCi_8LTZVE1sVlFOeFR4b2M/edit

Please note, the following fix: https://code.google.com/p/tridion-2011-power-tools/issues/detail?id=53

Answer 2

I experienced the same problem after 2013 SP1 upgrade. Tridion CS sent me NewUserExt - custom extension that overrides (at some sort) default new user actions. I would advise you to contact CS asking them for the extension.

Answer 3

This looks like you are hitting a limit on the LDAP server rather than in Tridion. You could confirm this by checking the logs of the LDAP server. (If you can say what kind of LDAP server you are using, that will give better context for the error message.) Another way to confirm it would be to execute a similar query directly using LDP or another suitable utility and seeing if you get the same result.

It's hard to see why upgrading Tridion would have this effect, however it's quite normal for LDAP servers to have quotas on the size of result sets they will return. It's also very common for these to be much more restrictive when the query is executed anonymously. (This is to prevent denial-of-service attacks.)

So if somehow your configuration got mangled during the upgrade, you might not be making the LDAP queries with the correct credentials. Double check your Search Account DN in the config. If it's empty, you'll get an anonymous bind, and your searches will probably succeed unless they hit a quota. To debug this properly, you need to get access to the LDAP server logs, which will show the bind occurring and whether it was successful.

Also consider whether the amount of data in the LDAP server has changed, and whether the amount of directory group mappings has changed.