On 28 Feb 2018, at 10:48, Alexander Bokovoy <abokovoy@redhat.com> wrote:

On ke, 28 helmi 2018, Sigbjorn Lie via FreeIPA-users wrote:
Hi list,

I have recently imported a DNS zone into IPA, having just over 14 000
records in the DNS zone. When trying to list the records in the webui,
there an error message is displayed "Search result has been truncated:
Configured administrative server limit exceeded”. I expected this with
such a large DNS zone, and the "Search time limit” and "Search size
limit” set to default.

What I didn’t expect, was when trying to search for a subset of
records, the same erors are displayed. The same error appear in both
the webui and the CLI using “ipa dnsrecord-find”. Some records show,
other records doesn’t show.

When I know the exact name of the record, I may display it using “ipa
dnsrecord-show” without any timeout errors.

I have tried increasing the time limit to 20 seconds and the size limit
to 20 000 using "ipa config-mod", which I know is well excessive,
however I still receive the same error message.

I do find the record using ldapsearch and searching for
"idnsName=dnsreco*”, so ldap itself it working when searching for a dns
record using a wildcard, however the IPA framework does not seem to
work.

Is there any setting I may tweak beside the "Search time limit” and
"Search size limit” to make the IPA framework successfully find the DNS
records?

BIND + dyndb-ldap is working just fine. All DNS records is served from
the large DNS zone.
Recently there was a bug fixed in 389-ds where anonymous bind limits
were leaking occasionally into authenticated bind access. It affected
GSS-SPNEGO SASL binds used by IPA framework. The fix for this is not
released yet:
https://pagure.io/389-ds-base/issue/49296
https://bugzilla.redhat.com/show_bug.cgi?id=1515190


-- 
/ Alexander Bokovoy

Ok, thank you for a rapid reply. :)


Regards,
Siggi