Weblogic:java.lang.RuntimeException: netscape.ldap.LDAPException: error result (4); Sizelimit exceeded

On Weblogic 12C configured LDAP authenticator and able to integrate LDAP successfully with Active directory . But When we click on the User & groups Tab i observer below error on the logs .

The exception happens after browsing through 1000 Users or Groups, a thousand being the default MaxPageSize on AD. By default, Microsoft Active Directory, which is a part of Windows 2000 Server, allows the fetching of only 1000 entries per single search request. As stated, this restriction is called MaxPageSize. The MaxPageSize value of the LDAPAdminLimits attribute controls the number of records that can be returned for an LDAP query. The default number is 1,000 records. If there are more than 1,000 items returned, Active Directory sees this maximum value and will return nothing. Microsoft Support says that “unless you have been instructed by Microsoft Product Support Services to use a different value, you should set this value back to 1,000”. Note that the tool that is used to lower the value of MaxPageSize, ntdsutil.exe, can equally be used to increase it, although it would seem Microsoft does not recommend this.

The Microsoft Active Directory Authentication Provider has been configured. But on WLS admin console or EM console, it was observed that listed users is up to 1000 users.

The Active Directory server by default is restricting the number of objects that are returned in a single search result.

MaxPageSize – This value controls the maximum number of objects that are returned in a single search result, independent of how large each returned object is. To perform a search where the result might exceed this number of objects, the client must specify the paged search control. This is to group the returned results in groups that are no larger than the MaxPageSize value. To summarize, MaxPageSize controls the number of objects that are returned in a single search result.

Default value: 1,000

To increase MaxPageSize value at AD side to a higher number.
Follow the instructions provided below for setting the MaxPageSize value to a custom value(e.g:3000) from default(1000)

C:> ntdsutil
ntdsutil: ldap policies
ldap policy: connections
server connections: connect to server $Server_Name
Binding to $Server_Name ...
Connected to $Server_Name using credentials of locally logged on user.
ldap policy: show values

Policy                          Current(New)

MaxPoolThreads                  4
MaxDatagramRecv                 4096
MaxReceiveBuffer                        10485760
InitRecvTimeout                 120
MaxConnections                  5000
MaxConnIdleTime                 900
MaxPageSize                     1000
MaxQueryDuration                        120
MaxTempTableSize                        10000
MaxResultSetSize                        262144
MaxNotificationPerConn                  5
MaxValRange                     1500

ldap policy: set MaxPageSize to 3000    
ldap policy: Show Values

Policy                          Current(New)

MaxPoolThreads                  4
MaxDatagramRecv                 4096
MaxReceiveBuffer                        10485760
InitRecvTimeout                 120
MaxConnections                  5000
MaxConnIdleTime                 900
MaxPageSize                     1000(3000)
MaxQueryDuration                        120
MaxTempTableSize                        10000
MaxResultSetSize                        262144
MaxNotificationPerConn                  5
MaxValRange                     1500

ldap policy : commit changes
ldap policy : q
ntdsutil : q

Related Posts

ERR_HTTP2_PROTOCOL_ERROR on Weblogic application access

How to enable DEBUG in OHS ?

Leave a Reply Cancel reply