At 01:28 PM 4/26/2006, Jon Roberts wrote:
>qazmlp wrote:
>>I'm unable to find the differences between the 'sizeLimitExceeded' and
>>'administrativeLimitExceeded' errors.
>>When exactly these errors are reported by the LDAP server?
>
>LDAP Error 4: Size Limit Exceeded
>Either the server's or the client's specified limit on the number of search
>results was exceeded.
>LDAP Error 11: Admin Limit Exceeded
>To satisfy the search request, the server would need to process too many
>entries.
Actually, draft-ietf-ldapbis-protocol says:
sizeLimitExceeded (4)
Indicates that the size limit specified by the client was
exceeded before the operation could be completed.
...
adminLimitExceeded (11)
Indicates that an administrative limit has been exceeded.
That is, the former is a matter of SearchRequest.sizeLimit being
exceeded and the latter is a matter of a server-side policy
limit being exceeded. Unfornuately, sizeLimitExceeded is
returned by a number of server implementations (dating back to
U-Mich LDAP days, I believe) when SearchRequest.sizeLimit is
zero (Unlimited). Unless the client provided a non-zero
searchRequest.sizeLimit AND the number of entries returned
is less than the value of searchRequest.sizeLimit, it should
assume the server meant adminLimitExceeded when it returned
sizeLimitExceeded. When the number of entries returned is
equal to the value of searchRequest.sizeLimit, the client
cannot distinguish whether the searchRequest.sizeLimit restriction
or an administrative limit was be exceeded. Forunately, that
doesn't matter much.
I note that adminLimitExceeded can be returned whenever continuing
processing the request would violate the server policy.
Kurt
>I believe for some directory implementations, the admin limit is also called
>the "lookthrough limit". I don't see this parameter in OpenLDAP server
>configuration directives (for recent versions), so it may be that OpenLDAP
>slapd would never throw an 11 error. I'm sure somebody will correct me if I'm
>wrong, though.
>
>Jon Roberts
>www.mentata.com
>
>---
>You are currently subscribed to [email protected] as: [EMAIL PROTECTED]
>To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as
>the SUBJECT of the message.
---
You are currently subscribed to [email protected] as: [EMAIL PROTECTED]
To unsubscribe send email to [EMAIL PROTECTED] with the word UNSUBSCRIBE as the
SUBJECT of the message.
