Anybody successfully used 4.1.3 for direct AD group enumeration?

[ucteam]

Just logged a support ticket recently regarding the direct group enumeration in PA 4.1.3 on a PA-5K .

It seemed that the firewall was only returning the first 1000 AD objects.. which is a default limit defined by the "MaxPageSize" variable in Active Directory.

LDAP clients making queries that exceed 1000 results will usually utilise the paging control http://www.ietf.org/rfc/rfc2696 to be able to perform succssive requests until all objects/results have been received. That doesnt seem to be happening in this case.. or possibly something else is going on..

Has anybody else encountered this issue? or is this an isolated case and people with larger AD structures not had the same issue..?

http://support.microsoft.com/kb/315071

MaxPageSize - This value controls the maximum number of objects that are returned in a single search result, independent of how large each returned object is. To perform a search where the result might exceed this number of objects, the client must specify the paged search control. This is to group the returned results in groups that are no larger than the MaxPageSize value. To summarize, MaxPageSizecontrols the number of objects that are returned in a single search result.

Default value: 1,000

[jdelio]

I was able to find some more information on this..

This is information reported from other users..  They were getting "size limit exceeded errors" in relation to this..

but they partially got around that..

"If I enable paging and set the LDAP browser to use a max page of 1000 objects (active directory default) then it still hits the “size limit exceeded” error message.. if I force the LDAP browser down to only use a max page size of 200 .. then it doesn’t seem to get that error.. but I have to expand the treeview down multiple times to keep retrieving the 200 more objects until it gets them all. "

I do not know if this will help or not.