On 28 Feb 2018, at 10:48, Alexander Bokovoy
<abokovoy(a)redhat.com> wrote:
On ke, 28 helmi 2018, Sigbjorn Lie via FreeIPA-users wrote:
> Hi list,
>
> I have recently imported a DNS zone into IPA, having just over 14 000
> records in the DNS zone. When trying to list the records in the webui,
> there an error message is displayed "Search result has been truncated:
> Configured administrative server limit exceeded”. I expected this with
> such a large DNS zone, and the "Search time limit” and "Search size
> limit” set to default.
>
> What I didn’t expect, was when trying to search for a subset of
> records, the same erors are displayed. The same error appear in both
> the webui and the CLI using “ipa dnsrecord-find”. Some records show,
> other records doesn’t show.
>
> When I know the exact name of the record, I may display it using “ipa
> dnsrecord-show” without any timeout errors.
>
> I have tried increasing the time limit to 20 seconds and the size limit
> to 20 000 using "ipa config-mod", which I know is well excessive,
> however I still receive the same error message.
>
> I do find the record using ldapsearch and searching for
> "idnsName=dnsreco*”, so ldap itself it working when searching for a dns
> record using a wildcard, however the IPA framework does not seem to
> work.
>
> Is there any setting I may tweak beside the "Search time limit” and
> "Search size limit” to make the IPA framework successfully find the DNS
> records?
>
> BIND + dyndb-ldap is working just fine. All DNS records is served from
> the large DNS zone.
Recently there was a bug fixed in 389-ds where anonymous bind limits
were leaking occasionally into authenticated bind access. It affected
GSS-SPNEGO SASL binds used by IPA framework. The fix for this is not
released yet:
https://pagure.io/389-ds-base/issue/49296
<
https://pagure.io/389-ds-base/issue/49296>
https://bugzilla.redhat.com/show_bug.cgi?id=1515190
<
https://bugzilla.redhat.com/show_bug.cgi?id=1515190>
--
/ Alexander Bokovoy
Ok, thank you for a rapid reply. :)
Regards,
Siggi