Active Directory Configuration Consideration for Sync LDAP User Directory Manager

Description

When synchronizing LDAP groups with the Sync LDAP User Directory Manager, groups with more than 1,500 members fail to create records in the dir_user_group table. Clicking the Sync Now button completes without error, but users from large groups are not imported. Smaller groups with fewer than 1,500 members are synchronized correctly.

This behavior occurs due to Active Directory’s Attribute Range Retrieval, where groups with over 1,500 members return attributes in ranged segments (e.g., member;range=0-1499) instead of a single member attribute. The current implementation does not handle ranged attributes, resulting in empty or missing user-to-group mappings.

Cause

• Active Directory returns member attributes in ranged format for large groups (member;range=0-1499).

• The current Sync LDAP plugin expects the key member and does not recognize ranged attributes.

• Default MaxValRange in Active Directory is 1,500, which triggers this behavior for large groups.

Solution

To avoid missing users, the total members in any group should not exceed the MaxValRange. If larger groups are required, corresponding adjustments or tweaks in Active Directory are necessary to ensure all members are retrieved during synchronization.

Related Documentation

• Sync LDAP User Directory Manager