Hi Mark, Thank you very much for your quick and detailed answer. I'm a bit confused with some details I do not understand. I ran this query and I got back only the user entires. Arent's also the groups part of this (since they can be members of other groups etc)? In case this is supposed to be the expected behavior, after checking the attribute 'nsslapd-idlistscanlimit' I saw that it is already set to 100.000 (and the entries that we got back from the query were 63000). I noticed that none of the entries had the 'nsmemberof' object class explicitly. How is this class used by default in freeIPA concerning users and groups? Again I'm super curious about the groups that do have the memberOf attribute but were not returned in the aforementioned query.
At this point, I would really like to mention, how much we appreciate the help and the very quick answers we've got so far from this mail-list. Thank you! Best Regards Mary Georgiou