Not all users syncing during Filr LDAP sync against Microsoft Active Directory

  • 7012436
  • 17-May-2013
  • 01-Apr-2014

Environment

Novell Filr 1.0.0
Novell Filr 1.0.1
Microsoft Active Directory

Situation

When syncing LDAP membership with Active Directory, containing a large number of users or group with a large number of users, the following errors may be seen:
 
Handler execution resulted in exception - forwarding to resolved error view
java.util.NoSuchElementException: Attribute member has no value
at javax.naming.directory.BasicAttribute.get(BasicAttribute.java:309)

Resolution

In Active Directory there are two settings for changing the MaxPageSize (the number of users returned in a query) and MaxValRange (The number of users in a group returned in a query)

MaxPageSize Default:
1000

MaxValRange Defaults:
Windows 2000 1,024
Windows Server 2003  1,500

Changing MaxPageSize & MaxValRange values in Windows 2000/Windows 2003 Active Directory Server:

  1. Run Ntdsutil.exe from the Run prompt
  2. At the Ntdsutil.exe command prompt, type LDAP policies, and then press ENTER.
  3. At the LDAP policy command prompt, type connections, and then press ENTER.
  4. At the server connection command prompt, type connect to server DNS name of server, and then press ENTER. You want to connect to the server that your are currently working with.
  5. At the server connection command prompt, type q, and then press ENTER to return to the previous menu.
  6. At the LDAP policy command prompt, type Show Values, and then press ENTER.
  7. At the LDAP Policy command prompt, type set MaxValRange to 5000 and then press ENTER
  8. At the LDAP Policy command prompt, type set MaxPageSize to 20000 and then press ENTER
  9. At the LDAP Policy command prompt, type Commit Changes and then press ENTER
  10. At the LDAP Policy command prompt, type Show Values and then press ENTER to see the updates.

Now, this will allow sizes up to 20000 in a page, and 5000 members in a group. However, please note that Microsoft has enabled some hard limits in some of their Server Products. In Windows 2008 and Windows 2008 R2, there are hard coded maximums for these values.  Even if the settings are changed, as described above, the maximum are still:

 MaxPageSize                    20000
 MaxValRange                   5000

The resolution to this is outlined in the documentation:
https://www.novell.com/documentation/novell-filr1/filr1_readme_novell/data/filr1_readme_novell.html#b152wusm
Hardcoded LDAP limitation of 20,000 (the default limitation is 5,000) with Windows Server 2008 R2 and Windows Server 2008 can result in LDAP returning less information for a single LDAP query.
To work around this issue, set up an LDAP connection for each subcontainer (by clicking Add a New LDAP Source from the LDAP configuration page in Filr) and run each LDAP connection in sequence.

November 2013 Update: A patch for this is available to allow synchronizing more than 20,000 users in Filr 1.0.1 Hot Patch 1, available via the Novell Patch Finder..

April 2014 Update: An updated patch for this is available to allow synchronizing large number of groups in addition to large number of users. Please contact Novell Technical Support with reference to this TID and request the patch.

Cause