On Tue, Sep 04, 2012 at 04:00:57PM +0000, Wojtak, Greg (Superfly) wrote:
Every once in a while with SSSD, we run into a problem where we
aren't able to get user information or authenticate users. We are using ldap/kerberos
against an Active Directory set up over SSL (LDAPS) and we see the following message in
encoded packet size too big (813957100 > 16777215)
are you using ldap:// or ldaps:// schema to connect to the AD server?
If you are getting the same error with ldapsearch & friends, then the
issue is not inside SSSD. This error happens when the AD issues a PAC
that is too big for the SASL library to handle -- the PAC contains
information about users and groups as well and might grow in a very
From what I've been able to gather, this is something to do with
the cyrus-sasl package. I've also seen this error pop up when doing operations with
the openldap-clients (ldapsearch, ldapmodify). I've found that by specifying the
minssf and maxssf values in the ldap* operations that the operations would then succeed.
I'm wondering if the same type of fix would work for SSSD? Is there a way to specify
the SSF of the SASL operations that SSSD uses? Is there another workaround for this?
You can use the ldap_sasl_minssf option to fine-tune the SSF. The code
path that uses the option value is the same as openldap-clients
utilities use, so if you were able to find a value that works for you
with ldapsearch, then the same should work with the SSSD, too.