[SSSD-users] Encoded Packet Size Too Big

Simo Sorce simo at redhat.com
Tue Sep 4 17:54:03 UTC 2012


On Tue, 2012-09-04 at 17:50 +0000, Wojtak, Greg (Superfly) wrote:
> On 2012-09-04 12:17 PM, "Jakub Hrozek" <jhrozek at redhat.com> wrote:
> 
> >On Tue, Sep 04, 2012 at 04:00:57PM +0000, Wojtak, Greg (Superfly) wrote:
> >> Every once in a while with SSSD, we run into a problem where we aren't
> >>able to get user information or authenticate users.  We are using
> >>ldap/kerberos against an Active Directory set up over SSL (LDAPS) and we
> >>see the following message in the logs:
> >> 
> >> encoded packet size too big (813957100 > 16777215)
> >> 
> >
> >Hi Greg,
> >
> >are you using ldap:// or ldaps:// schema to connect to the AD server?
> >
> >If you are getting the same error with ldapsearch & friends, then the
> >issue is not inside SSSD. This error happens when the AD issues a PAC
> >that is too big for the SASL library to handle -- the PAC contains
> >information about users and groups as well and might grow in a very
> >large organization.
> >
> >> From what I've been able to gather, this is something to do with the
> >>cyrus-sasl package.  I've also seen this error pop up when doing
> >>operations with the openldap-clients (ldapsearch, ldapmodify).  I've
> >>found that by specifying the minssf and maxssf values in the ldap*
> >>operations that the operations would then succeed.
> >> 
> >> I'm wondering if the same type of fix would work for SSSD?  Is there a
> >>way to specify the SSF of the SASL operations that SSSD uses?  Is there
> >>another workaround for this?
> >> 
> >
> >You can use the ldap_sasl_minssf option to fine-tune the SSF. The code
> >path that uses the option value is the same as openldap-clients
> >utilities use, so if you were able to find a value that works for you
> >with ldapsearch, then the same should work with the SSSD, too.
> >_______________________________________________
> >sssd-users mailing list
> >sssd-users at lists.fedorahosted.org
> >https://lists.fedorahosted.org/mailman/listinfo/sssd-users
> 
> 
> 
> I am not specifying a schema but verified that sssd is using ldaps:// -
> tcpdump and netstat show connections to my DC's on port 636 and none on
> 389.
> 
> I'll play around with the ldap_sasl_minssf and see if that causes the
> errors to disappear (similar to how ldap* commands did) and report back.
> 
> Hate to sound thick, but what exactly is a PAC?  I've seen it in related
> threads and searches but have been unable to find a decent definition...

http://msdn.microsoft.com/en-us/library/cc237917%28v=prot.13%29.aspx

However it comes into play only when using GSSAPI for LDAP binds. 

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York



More information about the sssd-users mailing list