search

pingidentity / ldapsdk

UnboundID LDAP SDK for Java
Other
331 stars 79 forks source link

Error "000020E6: SvcErr: DSID-031406E4, problem 5012 (DIR_ERROR), data 7" while searching with paginated request #101

Open wsolaligue opened 3 years ago

wsolaligue commented 3 years ago

Hey Guys, I'm getting the following exception 

Caused by: com.unboundid.ldap.sdk.LDAPSearchException: 000020E6: SvcErr: DSID-031406E4, problem 5012 (DIR_ERROR), data 7
\00
    at com.unboundid.ldap.sdk.LDAPConnection.search(LDAPConnection.java:3966)

while searching with paginated requests, a filter like (&(objectclass=group)) and I' asking for the following attributes distinguishedName, sAMAccountName, userPrincipalName, primarygroupid, whenChanged, objectGUID, objectSid, LDAP connections are provided by a LDAPThreadLocalConnectionPool, the AD server has around 70k groups, this problem happened after 50 iterations, each request had a limit of 1000 entries, is this a known problem? or what could it cause this exception?

dirmgr commented 3 years ago

The LDAP SDK is throwing this exception because it has received an error response from Active Directory. The text of the exception "000020E6: SvcErr: DSID-031406E4, problem 5012 (DIR_ERROR), data 700" comes from Active Directory.

I'm not an AD expert by any stretch, but based on the information at https://docs.microsoft.com/en-us/windows/win32/debug/system-error-codes--8200-8999-, it looks like error code 0x20E6 (decimal 8422) is "ERROR_DS_CANT_RETRIEVE_CHILD", which has a description of "The child object could not be retrieved." I don't know what this means, but it suggests that the problem is in AD and not in the LDAP SDK.

nddipiazza commented 3 years ago

For what it's worth, I found some info about the error here: https://www.mickputley.net/2015/11/dns-error-4015.html this link agrees with @dirmgr :

Description:
The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is "000020E6: SvcErr: DSID-031406C7, problem 5012 (DIR_ERROR), data 2". The event data contains the error.

Just some sort of blip in AD, or in the DNS server that resolves to AD. Retries may be a suitable "fix" for this.