WR LDAP user admin in v10 broken if you have over 1000 objects in AD

Reporting
1

Has anyone else run into this new issue with v10 of Web Reports where user administration shows empty values for LDAP query data if your number of group objects in your AD domain is over the default 1000 limit and if so, what did you do to get around it? (other than asking your AD team to increase it)

This is what support says is the reason:

"WebReports 9.5 is working with the old legacy mode (UseLegacyADLogin =1), that was the only AD mode until BigFix 9.0 and that was replaced by the new mode since BigFix 9.1 and maintained for backward compatibility;
WebReports v10, instead, is working with the new mode (this is default mode, if the environment was originally installed at BigFix version >= 9.1).

Due to that, the two environments are following different ways to collect information from the AD:

the “legacy mode” WebReports is directly connecting to the AD and gathering the related data
the “current mode” WebReports doesn’t connect directly to the AD and requests AD data through BigFix Server

The two “modes” have different ways to search data from the AD and may require different configurations.

That explains why the AD search limit is not hit on WebReports 9.5 in legacy mode."

2

I was surprisingly allowed to increase the LDAP maxpagesize value to 50k and problem is gone.

3

Also needed to add this reg key on server where WR is installed.

[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\BigFix\Enterprise Server\BESReports]
“LDAPSearchMaxResults”=“50000”

1 Like
4

I…actually hadn’t noticed that. I work often in an environment with a couple hundred thousand user accounts and tens of thousands of groups…Web Reports lookups work, but I realize now I’ve never “just browsed”, I’ve typed in partial group names or usernames and it finds the result successfully.

5

We were seeing missing entries for the groups but now we don’t after the changes. Actually, we see duplicates now (which we are addressing with support) but we made progress. The line with Administrator on it is where we were seeing nothing but ( )

image
image1088Ă—579 42.2 KB

6

We see duplicates because we have 2 datasources defined and both use same LDAP directory and same permissions granted.

Since it makes the user think its a bug, we have this, https://bigfix-ideas.hcltechsw.com/ideas/BFPTCH-I-193

Please vote