Skip to main content
SamuelRed
SamuelRed
New Member
January 28, 2016
Question

Maximum User Query Result with LDAP

  • January 28, 2016
  • 3 replies
  • 9530 views

Hi All,

 

I have a case with Fortigate/FortiOS ldap authentication with Zimbra as a directory services.

No issue with the connection, but found issue with query result. When I wont to add user with remote-auth method (remote ldap-user), fortigate just query for 1000 user only, whereas the number of users is 5000.

 

I try to searching one valid uid (user), but not exist in user list. (attached)

 

If the maximum ldap query limited at 1000, can I get the document who stated that? or any idea/trick to solving the issue?

 

thanks in advanced

Samuel R.

146

3 replies

awasfi_FTNT
Staff
awasfi_FTNT
Staff
January 28, 2016

Hello,

 

It's by design to limit the LDAP server and FGT load. Also searching through more than 1000 records will be difficult.

However all users should be retrieved by the LDAP query.

What you can do is using the custom TAB to filter the records that you want to add.

 

Regards,

awasfi_FTNT
Staff
awasfi_FTNT
Staff
January 28, 2016

Also Windows Server 2003 LDAP for example has "MaxPageSize = 1000" be default.

I'm not sure if you changed this value to more than 1000, it will shows more records on the FortiGate.

 

xsilver_FTNT
Staff
xsilver_FTNT
Staff
February 17, 2016

Hello,

 

FortiOS does LDAP searchRequest with paged controll set. Bu default and as industry usual it's set to 500 records. So LDAP server is asked to provide all the records (FortiOS do not request max size) but by 500 records chunks.

I'd suggest to use packet capture (GUI) or 'diag sniff packet' (CLI) FortiOS tools to see what happen in LDAP traffic.

This should help you determine on which side issue happen.

As it was mentioned it might be limitation of LDAP server.

It might be that LDAP server responses too slow and connection times out before all records are collected.

 

You can also open a ticket on support site or through the Fortinet Partner close to you.

 

Kind regards,

Tomas

SamuelRed
SamuelRedAuthor
New Member
February 18, 2016

Hi All,

 

sorry I just response this thread,

and the issue is solve by manually adding/import the remote user in LDAP with CLI bulking script. I imported based on uid in LDAP.

Luckily my customer have a list of uid user in csv file, so make me more easily :)

 

thanks

Samuel

154
Terms & ConditionsAccessibility statement