[SSSD-users] Encoded Packet Size Too Big

Jakub Hrozek jhrozek at redhat.com
Tue Sep 4 16:17:57 UTC 2012


On Tue, Sep 04, 2012 at 04:00:57PM +0000, Wojtak, Greg (Superfly) wrote:
> Every once in a while with SSSD, we run into a problem where we aren't able to get user information or authenticate users.  We are using ldap/kerberos against an Active Directory set up over SSL (LDAPS) and we see the following message in the logs:
> 
> encoded packet size too big (813957100 > 16777215)
> 

Hi Greg,

are you using ldap:// or ldaps:// schema to connect to the AD server?

If you are getting the same error with ldapsearch & friends, then the
issue is not inside SSSD. This error happens when the AD issues a PAC
that is too big for the SASL library to handle -- the PAC contains
information about users and groups as well and might grow in a very
large organization.

> From what I've been able to gather, this is something to do with the cyrus-sasl package.  I've also seen this error pop up when doing operations with the openldap-clients (ldapsearch, ldapmodify).  I've found that by specifying the minssf and maxssf values in the ldap* operations that the operations would then succeed.
> 
> I'm wondering if the same type of fix would work for SSSD?  Is there a way to specify the SSF of the SASL operations that SSSD uses?  Is there another workaround for this?
> 

You can use the ldap_sasl_minssf option to fine-tune the SSF. The code
path that uses the option value is the same as openldap-clients
utilities use, so if you were able to find a value that works for you
with ldapsearch, then the same should work with the SSSD, too.


More information about the sssd-users mailing list