[SSSD-users] Encoded Packet Size Too Big

Wojtak, Greg (Superfly) GregWojtak at quickenloans.com
Tue Sep 4 17:50:08 UTC 2012


On 2012-09-04 12:17 PM, "Jakub Hrozek" <jhrozek at redhat.com> wrote:

>On Tue, Sep 04, 2012 at 04:00:57PM +0000, Wojtak, Greg (Superfly) wrote:
>> Every once in a while with SSSD, we run into a problem where we aren't
>>able to get user information or authenticate users.  We are using
>>ldap/kerberos against an Active Directory set up over SSL (LDAPS) and we
>>see the following message in the logs:
>> 
>> encoded packet size too big (813957100 > 16777215)
>> 
>
>Hi Greg,
>
>are you using ldap:// or ldaps:// schema to connect to the AD server?
>
>If you are getting the same error with ldapsearch & friends, then the
>issue is not inside SSSD. This error happens when the AD issues a PAC
>that is too big for the SASL library to handle -- the PAC contains
>information about users and groups as well and might grow in a very
>large organization.
>
>> From what I've been able to gather, this is something to do with the
>>cyrus-sasl package.  I've also seen this error pop up when doing
>>operations with the openldap-clients (ldapsearch, ldapmodify).  I've
>>found that by specifying the minssf and maxssf values in the ldap*
>>operations that the operations would then succeed.
>> 
>> I'm wondering if the same type of fix would work for SSSD?  Is there a
>>way to specify the SSF of the SASL operations that SSSD uses?  Is there
>>another workaround for this?
>> 
>
>You can use the ldap_sasl_minssf option to fine-tune the SSF. The code
>path that uses the option value is the same as openldap-clients
>utilities use, so if you were able to find a value that works for you
>with ldapsearch, then the same should work with the SSSD, too.
>_______________________________________________
>sssd-users mailing list
>sssd-users at lists.fedorahosted.org
>https://lists.fedorahosted.org/mailman/listinfo/sssd-users



I am not specifying a schema but verified that sssd is using ldaps:// -
tcpdump and netstat show connections to my DC's on port 636 and none on
389.

I'll play around with the ldap_sasl_minssf and see if that causes the
errors to disappear (similar to how ldap* commands did) and report back.

Hate to sound thick, but what exactly is a PAC?  I've seen it in related
threads and searches but have been unable to find a decent definition...

Thanks!

Greg Wojtak
Sr. Unix Systems Engineer
Office: (313) 373-4306
Cell: (734) 718-8472



 



More information about the sssd-users mailing list