1500 user limit on LDAP

[baccord35]

Query re. Smart Directory - AD integration... working system with AU and LDAP group defined correctly BUT if the AD 'container' (CN=test-users) contains >1500 users it comes up empty and users rejected... with 1499 is fine! Any ideas why?

[chillyjim]

It is because by default a single AD query can only return 1500 entries (including the base entry).
There is an AD mod to adjust this.

[baccord35]

"LDAP directory servers can impose a limit on the size of results that are allowed to be returned from a query. The AD LDAP implementation has a default limit of 1500 users. Importing an LDAP directory with more users than the imposed limit will cause the import to fail. To increase the number of results returned by a query amend the "MaxPageSize" value within the ldap policy on the directory server to a value >1500 to allow a greater number of users to be imported at once."
Thanks. (this was news to our AD administrator.....)

[chillyjim]

Originally Posted by baccord35

(this was news to our AD administrator.....)

He shouldn't feel bad, its news to a lot of folks. Not something you run into everyday

[baccord35]

Our AD guys (WinSrv2003) are disputing Checkpoint's own explanation;
there are limits on server resources available to clients equesting LDAP queries, query policy is stored as a multivalue attribute (LDAPAdminLimits) configurable at server level; the default MaxValRange is (funnily enough) = 1500 whereas if the MaxPageSize (default value = 1000 NOT 1500) is the issue then the client can/should ask for paged results, which are supported by AD default query policy. They don't want to dramatically increase the MaxValRange suggesting CP use paged results, we suspect CP doesn't do paged results, we have tried to confirm with CP but having initially given us a confident answer now they are not talking to us...maybe trying to remember how their product works?
Anyone else have experience in this specialised area?

[chillyjim]

You are not going to get an answer like that out of normal support channels. Your Check Point SE may be able to help, but with a valid solution that came from MS, I really doubt you will get a code change.

[baccord35]

we had exactly that conversation , so we're testing scripts to break down the too-large group into multiple smaller ones, re-define an AU to point only to 1 branch, tick option to allow all users in the branch rather than use an individual ldap group (would now need multiple such groups). which is all do-able but a bit of a pain...