Bug 848031

Summary:	Range Retrieval: Unable to retrieve all members when filter is used in search base.
Product:	Red Hat Enterprise Linux 6	Reporter:	Jakub Hrozek <jhrozek>
Component:	sssd	Assignee:	Stephen Gallagher <sgallagh>
Status:	CLOSED WONTFIX	QA Contact:	IDM QE LIST <seceng-idm-qe-list>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.4	CC:	dpal, grajaiya, jgalipea
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-08-16 13:21:43 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jakub Hrozek 2012-08-14 11:25:37 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/sssd/ticket/1471

Setup:
- Add a group with 200 member users in AD
- Change the value of MaxValRange on the AD Server to 50
- Verified with ldapsearch to the AD Server, that only a range of 50 members are displayed at a time:
{{{
member;range=0-49: CN=rangeuser03,CN=Users,DC=sssdad,DC=com
member;range=0-49: CN=rangeuser02,CN=Users,DC=sssdad,DC=com
member;range=0-49: CN=rangeuser01,CN=Users,DC=sssdad,DC=com
....
}}}

1. Lookup the group:
Result:
"getent group groupname" returns all 200 users. <== Correct behaviour


2. Add "ldap_group_search_base = dc=sssdad,dc=com??(cn=groupname)" in sssd.conf domain section
Result:
"getent group groupname" only returns first 50 members.   <== Should have returned 200 members.

As per the filter, there shouldn't be any restriction on the no. of members being displayed.

Comment 1 Dmitri Pal 2012-08-16 13:21:43 UTC

We will update the man page.