LDAP not working up 1.000 users

[andbrslz]

When you have more than a thousand users the error is displayed and it is not possible to login with any ldap user

ERROR:
[15:29:41] [ERR] [25] Emby.Server.Implementations.HttpServer.HttpListenerHost: Error processing request. URL: http://localhost/Users/authenticatebyname
LdapException: Sizelimit Exceeded (4) Sizelimit Exceeded

System (please complete the following information):

• OS: Linux Ubuntu
• Virtualization:Docker
• Clients: All
• Jellyfin Version: 10.5.5
• Installed Plugins: LDAP v6
• Reverse Proxy: nginx

[joshuaboniface]

Sounds like a limitation of how we're doing LDAP with the plugin. It returns a full list of users using the Novell library, then parses that list. That error is coming from the Novell library itself, so that must be a hard limit there.

Are all 1000+ users actually Jellyfin users? If not, you could probably limit the search string to only catch them (for instance using an enabledService field), but if not this might be a hard limit. I'll do some digging.

[joshuaboniface]

@andyhoo Can you enable debug logging in the Jellyfin server and send the full logs of the LDAP transaction? I'm curious if some of the other messages give more info about where this is happening. My own LDAP instance has nowhere near that many users so reproducing might be hard.

[joshuaboniface]

Checking their docs (https://www.novell.com/documentation/developer/ldapcsharp/?page=/documentation/developer/ldapcsharp/cnet/data/bovtz77.html) there's no mention of a limit, but 1000 doesn't seem that large to me. More logging will hopefully provide clues.

[Hayajiro]

The limit is enforced by the respective LDAP-Server. You can try increasing the limit on your LDAP-Server. Alternatively, one could implement paged search, but documentation on implementing it isn't all that great, as far as I've seen.

However, limiting the query to those users that really need access to Jellyfin (e.g. by a group etc.) should also "circumvent" the issue.

Also, please make sure not to open multiple issues with the same topic. This is a duplicate of #35 (also created by you).

[Rob4001]

@Ciapa is correct, I use this library (albeit an older version) in my day job and it is a LDAP server mandated limit, generally on ActiveDirectory based servers but some implementations also include it: https://ldapwiki.com/wiki/MaxPageSize

My suggestion would be to include a configuration option to enable either Simple or VLV Paging to the searches, Example here: https://github.com/dsbenghe/Novell.Directory.Ldap.NETStandard/blob/master/original_samples/Samples.Controls/VLVControl.cs

I may have some time over the next few days to get a PR together, perhaps add a few tests

[h3ge]

Is it really necessary to evaluate all users?

For user group checks I usually use something like this:

(&(memberOf:1.2.840.113556.1.4.1941:=CN=MyUserGroup,DC=Groups,DC=dummy,DC=local)(objectClass=user)(sAMAccountName=%ESCAPEDUSERNAME%))

If several attributes are to be used as login name, the filter must be adapted accordingly.

[sphaero]

I'm running into this issue as well and I cannot create a filter which only results <1000 users. Why is there a query for the full list of users anyway?

[sphaero]

Not sure why this is closed but I'm running into this with 10.8.8-1 with the plugin from the catalog.

Feb 07 15:41:41 pong jellyfin[9161]: [15:41:41] [ERR] Error processing request. URL POST /ldap/LdapUserSearch.
Feb 07 15:41:41 pong jellyfin[9161]: LdapException: Size Limit Exceeded (4) Size Limit Exceeded
Feb 07 15:41:41 pong jellyfin[9161]: LdapException: Matched DN:

[ParhamGhafouri]

Greetings,

I have this problem on my organization with more than 1000 users to query from LDAP server and still facing "Base Search: Size Limit Exceeded" and "Failure: User Filter: Size Limit Exceeded". was wonder if there is any workaround to fix this problem.

[sphaero]

Better move your attention to #139. We need to implement the ldap plugin differently. It's quite a trivial fix but requires understanding LDAP. I'm still evaluating Jellyfin so I have no time yet to work on it.

[ParhamGhafouri]

Greetings and Thanks , I did post on #139