Comments on: AD Integration Tip: Dealing With More Than 1,000 Users

By: Doug Woodgate

Doug Woodgate — Wed, 30 Apr 2008 19:39:36 +0000

Below is from the man page of nss_ldap, it should work like this, but I still had problems with it I think. I was running into an issue that some users wouldn’t show up under a global getent passwd, but would with getent passwd username. I figured this was the cause, and may be, but under Red Hat Server 5, it apparently doesn’t work. How I fixed it was appending a search filter in ldap.conf

nss_paged_results
Enables support for paged results.

pagesize
When paged results are enabled (see above), specifies the number of entries to return in a single page. The default is 1000.

Search Filter I applied to reduce the count and make it feel a little quicker.
nss_base_passwd dc=mybpc,dc=net?sub?&(objectCategory=user)(uidNumber=*)

-Doug

By: Jan Ivar Beddari

Jan Ivar Beddari — Wed, 16 Apr 2008 16:13:36 +0000

Ah, this old problem again Luckily there is now a lot of sample code around the net that shows how you can do paged searches against AD correctly.

http://forum.java.sun.com/thread.jspa?threadID=5117992&tstart=0

By: Jef

Jef — Tue, 15 Apr 2008 05:37:32 +0000

Scott,

I agree that I should offer some helpful information other than just saying “don’t”, so I wrote up some information here which I hope provides some help:

http://jeftek.com/iam/activedirectory/avoid-changing-the-maxpagesize-ldap-query-policy/

By: slowe

slowe — Tue, 15 Apr 2008 01:01:53 +0000

OK, I hear everyone saying just how bad it is to increase MaxPageSize, but I don’t hear anyone telling us how to fix the problem that increasing MaxPageSize fixes. It’s all well and good to say “Don’t do that!”, but what people really need is “Do this instead”. Anyone care to provide that information?

By: Jef

Jef — Mon, 14 Apr 2008 22:20:21 +0000

I would agree that messing with the maxpagesize is a very bad Idea.

As Brian said, as soon as you set it to 5,000, what if you grow to 5,001? Or even 10,000?

It’s a constant chasing the number as you grow, while all the time you are introducing potential issues with the infrastructure because of the load you may place on it.

Now how easy is it for you to tell an App owner to “Fix their app” and use paging? Unfortunately that is not always an easy task, but I tend not to want to change infrastructure to support an application, especially when supporting paging is a solution.

Jef

By: Anders

Anders — Fri, 11 Apr 2008 18:53:13 +0000

Atleast libnss_ldap has support for paging although it’s not enabled per default in all installations.
I would assume that winbind also handles paging.

Changing the pagesize should be the absolute last thing you consider doing (and yes, that’d be after bashing developers heads).

By: slowe

slowe — Fri, 11 Apr 2008 18:37:50 +0000

Brian,

OK, fair enough. How would you suggest handling this problem, then?

By: Brian Desmond

Brian Desmond — Fri, 11 Apr 2008 17:41:57 +0000

This is a really bad idea. This is not an AD limitation, it’s an application programming issue. This is the LDAP page size - standard thing across any LDAP directory. 1,000 is the max number of records returned in a result set so the app has to support paging to get more.

This is not a best practice and yes it can cause problems. The other problem is once you do it once, you set the precedent to keep doing it.