Introduction
In certain scenarios, when searching for LDAP groups under Authentication -> LDAP -> LDAP Group Settings, the search may not return one or more of the configured groups.
This outcome may be caused by LDAP's pagination limit, which defaults to restricting the number of records returned in a single query to 1000.
For more details, please refer to the official Microsoft documentation here.
We can confirm this behavior by performing direct searches against the LDAP server. For example:
1. To retrieve the entire group list under a specific DN without specifying a user:
ldapsearch -x -b "ou=Organization,dc=openstack,dc=org" "(objectClass=groupOfNames)"
2.To retrieve the group list that a specific user belongs to under a specific DN:
ldapsearch -x -b "ou=Organization,dc=openstack,dc=org" "(&(objectClass=groupOfNames)(member=cn=User1,ou=Users,ou=Organization,dc=openstack,dc=org))"
Possible workarounds:
- Decreasing the search base for the LDAP group settings in Artifactory and adding additional ones.
- Increasing the page limitation on the Active Directory side: You may follow this Microsoft Article for adjusting the MaxPageSize attribute based on the total number of LDAP groups set up and re-invoke the group search in Artifactory.