I recently configured IMC UAM with LDAP synchronization at a customer. Some of the users would be allowed access to specific Wireless networks, others would not get access.
So to make the ongoing administration for the customer easier, it was decided to go for the AD Group based synchronization, so based on a specific AD Group membership, a different UAM Access Service would be assigned.
Since UAM will sync all users, an Access Service “No-Access” was defined, in which the “access forbidden” access policy was set and no other scenario’s were defined. This “No-Access” access service was set as the default for the UAM sync policy.
At this point, I could add the required AD Groups, and link them to the required Access Services. That was what I had expected …
The problem : AD LDAP Query returns only 1000 records…
When trying to select the actual AD groups, I could not find the groups in the list and the query function did not resolve the name either. So I checked the group type in the AD, but it was just a normal security group, so that was not the issue.
So Wireshark was fired up to trace the LDAP communication between UAM and the AD.
What I found is that the UAM query for group function in the LDAP sync policy wizard is not really a query. UAM will first request the complete list of groups through LDAP, and then apply the query string as a display filter in the UI.
So after reviewing the actual LDAP query (all groups), I noticed that only 1000 groups were returned, altough more groups existed in the AD. Since the 2 groups which were needed were not in this returned list, the UI query (or filter) of these groups did not return our groups either of course.
The solution : Update AD LDAP Policy to support more records per query
After checking on Google, the Active Directory MaxPageSize was found to be the source of this 1000 record limit. This value controls the maximum number of records which are returned in a single query. Once the value was updated to 2000, it started working just fine.
This was the procedure on the domain controllers performed by the domain admin. This was based on this Microsoft article : http://support.microsoft.com/kb/315071
The new value is updated on the fly, no need for restarting any server or services.
Query the Existing value
Update the value