Skip to main content
Version: 5.1.1.0

LDAP Microsoft Active Directory

Problem​

If you encounter an error like

javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name 'dc=...,dc=…' please try other ports to connect to the AD.

  • change the port 389 to 3268 (normal connection)
  • change the port 636 to 3269 (ldaps connection)

A GC (global catalog) server returns referrals on 389 to refer to the greater AD forest but acts like a regular LDAP server on 3268 (and 3269 for LDAPS).

If you import an Object class from the AD there are 2 special Microsoft attributes imported. Please remove these attributes manually:

  • msds-memberOfTransitive
  • msds-memberTransitive

If not, you will receive an error message like:

Caused by: javax.naming.NamingException: [LDAP: error code 1 - 00002120: SvcErr: DSID-03120451, problem 5012 (DIR_ERROR), data 592060.

In newer Version from Orchestra these attributes will be removed automatically.

To check limitations for Active Directory​

https://ldapwiki.com/wiki/Wiki.jsp?page=Microsoft%20Active%20Directory

Windows 2016 Server​

LDAPAdminLimits=
MaxValRange=1500
MaxReceiveBuffer=10485760
MaxDatagramRecv=4096
MaxPoolThreads=4
MaxResultSetSize=262144
MaxTempTableSize=10000
MaxQueryDuration=120
MaxPageSize=1000
MaxNotificationPerConn=5
MaxActiveQueries=20
MaxConnIdleTime=900
InitRecvTimeout=120
MaxConnections=5000

CN=Default Query Policy,CN=Query-Policies,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=soffico,DC=local

Microsoft_Acitve_Directory Configuration