Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know there are limits in LDAP queries, therefore I setup a user without limits. But even so I'm facing "Administrative Limit exceeded" error.

I include below an extract of the database configuration. I'm using the user cn=checkrepl,cn=users,dc=domain,dc=es.

esauro@ubuntu:~$ ldapsearch -x -W -D 'cn=admin,cn=config' -b 'cn=config' -h openldap1 'olcDatabase={1}hdb'
Enter LDAP Password: 
# extended LDIF
#
# LDAPv3
# base <cn=config> with scope subtree
# filter: olcDatabase={1}hdb
# requesting: ALL
#

# {1}hdb, config
dn: olcDatabase={1}hdb,cn=config
objectClass: olcDatabaseConfig
objectClass: olcHdbConfig
olcDatabase: {1}hdb
olcDbDirectory: /var/lib/ldap
olcSuffix: dc=domain,dc=es
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymou
 s auth by dn="cn=admin,dc=domain,dc=es" write by dn.subtree="cn=Managers,dc=domain,
 dc=es" read by * none
olcAccess: {2}to dn.base="" by * read
olcAccess: {3}to * by self write by dn="cn=admin,dc=domain,dc=es" write by * read
olcLastMod: TRUE
olcLimits: {2}dn="cn=checkrepl,cn=Users,dc=domain,dc=es" time.soft=unlimited time
 .hard=unlimited size.soft=unlimited size.hard=unlimited
olcSizeLimit: size=100000 size.unchecked=100000
olcMirrorMode: TRUE
olcMonitoring: TRUE
olcDbCacheSize: 200000
olcDbCheckpoint: 512 30
olcDbConfig: {0}set_cachesize 0 536870912 0
olcDbConfig: {1}set_lk_max_objects 1500
olcDbConfig: {2}set_lk_max_locks 1500

However whenever I query the directory and, if the result is big, I get the error, no matter whether or not I include the flags to limit the time and the size of the query.

esauro@ubuntu:~$ ldapsearch -z 40 -l 1000 -x -W -D 'cn=checkrepl,cn=users,dc=domain,dc=es' -b 'dc=domain,dc=es' -h openldap1 'uid=al*' dn
Enter LDAP Password: 
# extended LDIF
#
# LDAPv3
# base <dc=domain,dc=es> with scope subtree
# filter: uid=al*
# requesting: dn 
#

# search result
search: 2
result: 11 Administrative limit exceeded

# numResponses: 1

I'm using ldap-utils (version 2.4.23 and 2.4.28) as client and openldap (2.4.23) as server

EDIT: Another excerpt from the config including the indexes:

olcDbIndex: objectClass eq
olcDbIndex: uid eq,pres,sub
olcDbIndex: memberUid,uniqueMember eq
olcDbIndex: uidNumber,gidNumber eq,pres
olcDbIndex: sambaSID,sambaPrimaryGroupSID eq
olcDbIndex: sambaGroupType,sambaSIDList eq
olcDbIndex: entryCSN,entryUUID eq
olcDbIndex: ou,cn eq
olcDbIndex: mail,maildrop eq

EDIT 2: This exact configuration (Copy&Paste) is working perfectly in another LDAP using a more recent version of LDAP.

share|improve this question
    
How are sizelimit and timelimit configured on your server? –  fboaventura Feb 1 '13 at 9:44
    
The configuration is in the extract I posted. olcSizeLimit: size=100000 size.unchecked=100000. The limit for the user is explicitly set to unlimited in both case! –  esauro Feb 1 '13 at 10:15

1 Answer 1

You have olcDbCacheSize: 200000 (and a 512MB cache) indicating you may have a high number of directory entries.

You have size.unchecked=100000 which places limits on queries for attributes with no indexes.

There are no olcDbIndex attributes in your config [extract], so there are may be no indexes for searching.

If you have more than 100,000 entries, your search will need a full directory scan, and exceed its default size.unchecked limits, regardless of how many actually match uid=al*.

You really need indexes. Try running with olcLoglevel: stats index, and check your syslog configuration to make sure the facility (local4 is default) goes somewhere useful. Add indexes, including at least your common queries, and sub(string) indexes for uid, and run slapindex -v to update, slapd should not be running during the index generation.

http://www.openldap.org/doc/admin24/tuning.html

share|improve this answer
    
I have indexes. It is just an excerpt of the configuration, not all configuration. The query "uid=al*" should return about 40k entries, however more important is that rootdn can perform that query. –  esauro Feb 3 '13 at 8:40
    
Limits (and ACLs) are not applied to the rootdn. Do you have sub or subinitial indexes on uid? What indexes do you have in place? Check your /var/lib/ldap directory for a large uid.bdb index file. Did you bulk import using slapadd? –  mr.spuratic Feb 3 '13 at 13:16
    
I modified the entry including the indexes configuration. There is a 28M file uid.bdb in the ldap directory. Yes we use slapadd to import users. –  esauro Feb 4 '13 at 13:57
    
I estimate pres,eq,sub indexes at ~256 bytes per-entry, that tells me you only have ~110k entries indexed. Unless your uids mostly begin with "al", it doesn't look like your indexed data is complete (I guess ~2M entries). Did slapindex run to completion without error after slapadd? If you changed any olcDbIndex config a subsequent restart of slapd before completion of background indexing could explain this too. I suggest stop/slapindex -v/start as the next step. –  mr.spuratic Feb 4 '13 at 17:36
    
There are about 154k entries in directory and most of them (76.5k) begin with 'al' (I thought there were less entries starting with this substring). –  esauro Feb 6 '13 at 8:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.