grouper-users - [grouper-users] Large groups in Active Directory, failing to provision

Subject: Grouper Users - Open Discussion List

List archive

[grouper-users] Large groups in Active Directory, failing to provision

From: Brett Bieber <>
To: grouper-users <>
Subject: [grouper-users] Large groups in Active Directory, failing to provision
Date: Thu, 10 Dec 2015 22:41:18 +0000

We've encountered problems with the PSP not creating large groups (~30k) in Active Directory. The error shown in grouper_error.log is:
LDAP: error code 1 - 000021B1: SvcErr: DSID-0315300C, problem 5005 (UNABLE_TO_PROCEED), data 0

All Google signs point to Active Directory audit settings and a limit:

http://blog.hutch.ca/category/information-technology/active-directory/

http://serverfault.com/questions/470428/how-do-i-change-the-active-directory-auditing-events-maximum

There's little info on this undocumented setting, so I thought I'd reach out and see if anyone else had encountered group creation issues with AD groups larger than 17k members.

A couple questions:

Is there any configuration we can do to chunk out changes to AD in pieces?

Are we just encountering this because we have our auditing turned up higher than others? Here are our settings:

Any advice other than to create smaller groups?

Thanks,

-Brett

[grouper-users] Large groups in Active Directory, failing to provision, Brett Bieber, 12/10/2015

List archive

[grouper-users] Large groups in Active Directory, failing to provision