On 2012-09-04 12:17 PM, "Jakub Hrozek" <jhrozek(a)redhat.com> wrote:
On Tue, Sep 04, 2012 at 04:00:57PM +0000, Wojtak, Greg (Superfly)
wrote:
> Every once in a while with SSSD, we run into a problem where we aren't
>able to get user information or authenticate users. We are using
>ldap/kerberos against an Active Directory set up over SSL (LDAPS) and we
>see the following message in the logs:
>
> encoded packet size too big (813957100 > 16777215)
>
Hi Greg,
are you using ldap:// or ldaps:// schema to connect to the AD server?
If you are getting the same error with ldapsearch & friends, then the
issue is not inside SSSD. This error happens when the AD issues a PAC
that is too big for the SASL library to handle -- the PAC contains
information about users and groups as well and might grow in a very
large organization.
> From what I've been able to gather, this is something to do with the
>cyrus-sasl package. I've also seen this error pop up when doing
>operations with the openldap-clients (ldapsearch, ldapmodify). I've
>found that by specifying the minssf and maxssf values in the ldap*
>operations that the operations would then succeed.
>
> I'm wondering if the same type of fix would work for SSSD? Is there a
>way to specify the SSF of the SASL operations that SSSD uses? Is there
>another workaround for this?
>
You can use the ldap_sasl_minssf option to fine-tune the SSF. The code
path that uses the option value is the same as openldap-clients
utilities use, so if you were able to find a value that works for you
with ldapsearch, then the same should work with the SSSD, too.
_______________________________________________
sssd-users mailing list
sssd-users(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users
I am not specifying a schema but verified that sssd is using ldaps:// -
tcpdump and netstat show connections to my DC's on port 636 and none on
389.
I'll play around with the ldap_sasl_minssf and see if that causes the
errors to disappear (similar to how ldap* commands did) and report back.
Hate to sound thick, but what exactly is a PAC? I've seen it in related
threads and searches but have been unable to find a decent definition...
Thanks!
Greg Wojtak
Sr. Unix Systems Engineer
Office: (313) 373-4306
Cell: (734) 718-8472