52

We are seeing this warning messages in our logs

javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name 'dc=global,dc=com'

It appears whenever users log-in to our application.

As per this SO post, it can be resolved, by setting Context.REFERRAL to follow. But it increases the search time from 1 second to 4 seconds.

In fact you can refer this SO post, it says using follow slows down the search.

So my question is, what is the best way to get rid of this exception from our logs without affecting performance?.

Community
  • 1
  • 1
Karthik Bose
  • 33,556
  • 3
  • 33
  • 43

3 Answers3

80

Another possible solution that may work is to change the port number (assuming this is a GC server):

If you were using the port 389 change it to 3268

If you were using the port 636 change it to 3269

This may work because (and I quote):

A GC (global catalog) server returns referrals on 389 to refer to the greater AD "forest", but acts like a regular LDAP server on 3268 (and 3269 for LDAPS)

It worked for me.

I found this solution in the Shibboleth Users list, answered by Paul Caskey (all the credit to him).

You can check the conversation on this link:

https://lists.internet2.edu/sympa/arc/shibboleth-users/2008-06/msg00039.html

Community
  • 1
  • 1
Edenshaw
  • 1,692
  • 18
  • 27
  • 4
    Changing to port 3268/9 works great. Unfortunately, search and lookups only seem to return a partial set of attributes. For example, the employeeID attribute is never returned, even when explicitly queried. – Jeshurun Jan 19 '17 at 15:05
  • 1
    Global catalog haven't got all attributes (contains only subset). So it's not a solution for everyone. – jsosnowski Jul 10 '17 at 11:50
  • I am trying to login to LDAP through my program, my observation is - check the boxes "Password never expires" and "user cannot change his password" from AD. Then this error went away. – Bhushan Karmarkar Apr 02 '19 at 05:26
69

OK. You will be seeing this exception, when your search returns referral and you set to ignore the referral.

[Referral: When you search in AD, if AD thinks there are more information available in another place, it returns a referral [place to find more info] along with your search results.]

You could avoid this exception by setting Context.REFERRAL to follow. Then it would search in the referral also [That's why it takes more time to return result].

But in my case the referral is invalid and returned an another exception.

I fixed this issue by changing the baseDN (search base) to be more specific. E.g. ou=users,dc=mydomain,dc=com. Now I'm not seeing this exception, because it doesn't return any referral.

Ahmed Ashour
  • 5,179
  • 10
  • 35
  • 56
Karthik Bose
  • 33,556
  • 3
  • 33
  • 43
0

Both of the other two answers work by following any referral that is returned in the LDAP query. That's probably the recommended way in most situations.

However, if the requirement is if fact to use "ignore" so not to follow referrals, then a javax.naming.PartialResultException: Unprocessed Continuation Reference(s) will always be returned whenever a referral is found.

The solution is to also ignore the javax.naming.PartialResultException (by catching and swallowing it) when Context.REFERRAL is set to ignore. I recommend to at least log a warning though.

I assume this somehow awkward implementation of "ignore" was made to make sure that the caller is aware of the fact that partial results are really accepted.

not2savvy
  • 2,902
  • 3
  • 22
  • 37