LDAP Entitlement aggregation failing

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

Hi,

We are configuring an LDAP source with Generic LDAP connector. We have defined Group scope and Account scope to gather the entitlements and accounts respectively.

We are getting below error when we are running the entitlement aggregation-
sailpoint.connector.ConnectorException: [ ConnectorException ]
[ Error details ] [ ConnectorException ]
[ Error details ] Failed to aggregate.[LDAP: error code 4 - Sizelimit Exceeded]

1- When we ran the entitlement aggregation for the first time, it aggregated more than we expected. It aggregated users (which was part of the Account OU scope) under nisNetGroup and posixGroup type which was quite surprising as the Group filter was properly defined(Verfiied the ldap filter through apache directory studio) with objectClass=group and all the OUs are independent. .For eg

DC= abc, DC=com has 4 OUs-
-UserOU1
-UserOU2
-GroupOU1
-GroupOU2

So not sure why it was going for that user account OU. However the aggregation errored out with the above mentioned error.

2- We removed the nisNetGroup and posixGroup from the group schema from the source config to handle that. The count of the entitlement reduced with no nisNetGroup or posixGroup but it is ending with the same error.

We were thinking of something around paging thing but I believe we cannot do Paging for entitlement aggregation.
Any suggestions are truly appreciated

2

What type of LDAP (AD, Open LDAP etc.) are you trying to aggregate. It seems the LDAP is configured to limit number of entries and LDAP administrators can help with the issue if there is any size limit setting configured within LDAP.

You may want to refer to some of these articles to see if these suggestions helps fix your issue

https://community.sailpoint.com/t5/Identity-Security-Cloud-Forum/OpenLDAP-Aggregation-Error-Code-4-Sizelimit-Exceeded/td-p/61284

https://community.sailpoint.com/t5/IdentityIQ-Forum/SunOne-Direct-Aggregation-Issue/m-p/119551

Also see if you can set the page size as suggested in the following post for IIQ in IdentityNow

3

Thanks Sanjeev for the response.

Getting LDAP limit increase was out of the option as client was not willing to do it due to some past issues.

However, we resolved the issue using this link-Support Articles - [IdentityIQ] LDAP (non-AD) Connector Aggregation Error: LDAP: error code 4 - Sizelimit Exceeded