Bug 1966289

IPA does not reset the search limit on upgrades. I can't explain why yours apparently was, though since it is managed per-server is it possible that some had the value set and others did not?

As for why "ipa config-mod --searchrecordslimit=10000" doesn't update cn=config there are two reasons.

1. cn=config is not replicated so the command would have to contact every IPA server and change the value which can be problematic if, for example, one or more servers are not reachable.
2. IPA tries to discourage enumerating all of any given entry type and prefers to have the user provide a search term.

This is to prevent things like this common pattern from the NIS world: ypcat passwd | grep someuser

Rather than id someuser or getent passwd someuser

Is there a reason you need > 2000 entries from a search?

Additional info:
"ipa config-mod --searchrecordslimit=10000" writes the settings into cn=ipaConfig,cn=etc,$BASEDN (in the attribute ipaSearchRecordsLimit). This is a client-side setting, meaning that it limits the number of records asked by the commands "ipa *-find" or through the WebGUI.

If the client-side limit is set to 10000 but the server-side limit is lower, the server-side limit is enforced (can be set globally for the LDAP server below cn=config, or below cn=config,cn=ldbm database,cn=plugins,cn=config).

Back in 2011 in commit https://pagure.io/freeipa/c/9724251292e4c0797367fcc351a9f16f30c6aefe there was the intention to increase the search limits. Unfortunately there was an issue with the increase of nsslapd-sizelimit because of the way the update was written. By using the default keyword the value only gets set if one doesn't already exist, and since the server defaults to 2000, the value wasn't updated. We should correct this update file to be:

replace: nsslapd-sizelimit:2000:100000

Upstream ticket:
https://pagure.io/freeipa/issue/8962

Fixed upstream
master:
https://pagure.io/freeipa/c/b91c0afd0b5ae9eb4954078f8c76f2914daa1d85

Fixed upstream
ipa-4-9:
https://pagure.io/freeipa/c/3fb0f5333613beabeead3feb73dc0fea9694bcdc

Included with the rebase to 4.9.8

Pre-verified using:
ipa-server-4.9.8-1.el9.x86_64

    RHEL7.9
    [root@master ~]# rpm -qa ipa-server
    ipa-server-4.6.8-5.el7_9.10.x86_64
    [root@master ~]# ldapsearch -h localhost -D "cn=Directory Manager" -w Secret123 -b "cn=config" -xLLL | grep nsslapd-sizelimit
    nsslapd-sizelimit: 2000
    nsslapd-sizelimit: 2000

    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    RHEL9
    [root@master ~]# rpm -qa ipa-server
    ipa-server-4.9.8-1.el9.x86_64
    [root@master ~]# ldapsearch -h localhost -D "cn=Directory Manager" -w Secret123 -b "cn=config" -xLLL | grep nsslapd-sizelimit
    nsslapd-sizelimit: 100000
    nsslapd-sizelimit: 2000
    [root@master ~]#

Automation added upstream in  ipatests/test_integration/test_installation.py::TestInstallMaster::test_nsslapd_sizelimit
master:
https://pagure.io/freeipa/c/56e4f33ce630a6a310518f25b67d46fb31f7919e

Automation added upstream:
ipa-4-9:
https://pagure.io/freeipa/c/465f1669a6c5abc72da1ecaf9aefa8488f80806c

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: ipa), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2387