LDAP - failed to create page control

[migration]

Hi All,

Seen this in the ldapd.log file.

Has anyone come across this before ?

 Mar 16 10:10:03 connected to ldap server ldap://172.17.23.132
 Mar 16 10:10:03 ldap cfg LDAP Server connected to 172.17.23.132:389(index 0)
 Mar 16 10:10:09 Warning: pan_ldap_search(pan_ldap.c:521): failed to create page control
 Mar 16 10:10:09 Warning: pan_ldap_search(pan_ldap.c:521): failed to create page control
 Mar 16 10:10:09 Warning: pan_ldap_search(pan_ldap.c:521): failed to create page control
 Mar 16 10:10:09 Warning: pan_ldap_search(pan_ldap.c:521): failed to create page control
 Mar 16 10:10:09 Warning: pan_ldap_search(pan_ldap.c:521): failed to create page control
 Mar 16 10:10:09 Warning: pan_ldap_search(pan_ldap.c:521): failed to create page control
 Mar 16 10:10:09 Warning: pan_ldap_search(pan_ldap.c:521): failed to create page control
 Mar 16 10:10:09 Warning: pan_ldap_search(pan_ldap.c:521): failed to create page control

the "failed to create page control" pages for quite a bit.

Regards

Marc

[gswcowboy]

Out of curiosity, is the output via your syslog? Are you actually able to utilize the LDAP server for authentication?

[gswcowboy]

In eDir, a request is made by the PAN for group information (1000 at a time) and from this all users (1000 at a time), thus the need for page control. This way, the PAN will not be inundated by a possilbe 'dump' of data. Having said that, if you're running AD, page control is not a supported feature and you'll eventually receive these log messages. However, if you're running eDir version 8.7, you'll need to upgrade to version 8.8 to alleviate these alerts. Hope this answers your question.

[migration]

We are currently using a Donino (v6.5.x I think) for captive portal authentication, which seems to be working with the tests we have performed.

These logs are from the ldapd.log on the PA its self not via syslog.

using "show user ldap-server server all" the PA contact the LDAP server and returns all the groups and users in under 20 seconds, when viewing the ldapd.log imiedatly after the PA connects we recieve the "failed to create page control" warning in the log.

Im just concerened that this may have an impact on the users authenticating when we start migrating more users across.

Regards

Marc

[James]

Hi Marc,

This may impact results later on.

The LDAP quesry is looking to get all the user/group mappings - so the paging error probably means you're getting the 1st 1,000 results only.  This means - a valid user will likely get authenticated.  However, they may not end up in the correct group for security policies - you'll be able to see this on the device CLI - all user/group mappings.  Although it could be a big list to go through.

The question is whether your 1,000+ results are all users or something different - e.g. groups.

Filters on groups will help if there are a lot of groups being returned that you'll not use in security policy.

Filter on users, if you can, to get only the <1,000 that you need - assuming you have less than 1,000 that will authenticate in this way.

Of course, the above needs validating with checks on the CLI to see what you see.

Thanks

James

[migration]

Hi James,

With ldap page control I asume you are refering to RFC 2696 - LDAP Control Extension for Simple Paged Results Manipulation?

If so then I belive from the research I have done Lotus Domino versions 5,6 and 7 do not support this RFC.

So it looks like the customer is going to have to do some regrouping by Region to bring the returned numbers down... however if the total number of users in all groups exceeds 1,000+ would I still have the same issue??

Marc

[James]

Hi Marc,

I cannot comment on the RFC - perhaps someone can check this.

However, yes - if more than 1,000 lines are returned the problem will remain.  The company may not need to change their structure.  It is possible for example to filter user on their loction - assuming this information has been entered into the LDAP server.  Here are some examples of filters:

Use only users based in Dallas or Houston:

(|(l=Dallas)(l=Austin))

Only users named John in the same cities:

(&(givenName=John)(|(l=Dallas)(l=Austin)))

HTH

Thanks

James