[jcifs] Fragmented request PDUs currently not supported when calling getGroupMemberSids

[Anton Prevosti Vives]

Thanks, Mike.

That would explain it. I am not sure that the workaround will work for our application though... :(

Best regards,
Anton

----- Original Message -----
From: "Michael B Allen" <ioplex at gmail.com>
To: "Anton Prevosti Vives" <prevosti at vivisimo.com>
Cc: "JCIFS mailing list" <jcifs at lists.samba.org>
Sent: Wednesday, August 11, 2010 2:13:08 PM GMT -05:00 US/Canada Eastern
Subject: Re: [jcifs] Fragmented request PDUs currently not supported when  calling getGroupMemberSids

On Wed, Aug 11, 2010 at 1:23 PM, Anton Prevosti Vives
<prevosti at vivisimo.com> wrote:
> Hi all,
>
> A customer is reporting the following error:
> jcifs.dcerpc.DcerpcException: Fragmented request PDUs currently not supported
>        at jcifs.dcerpc.DcerpcHandle.sendrecv(DcerpcHandle.java:176)
>        at jcifs.smb.SID.resolveSids(SID.java:92)
>        at jcifs.smb.SID.resolveSids0(SID.java:137)
>        at jcifs.smb.SID.resolveSids(SID.java:206)
>        at jcifs.smb.SID.getGroupMemberSids0(SID.java:587)
>        at jcifs.smb.SID.getGroupMemberSids(SID.java:613)
>
>
> The values we are passing to the method are:
> SID.getGroupMemberSids(server_url, credentials, SID.SID_FLAG_RESOLVE_SIDS)
>
>
> The customer said that the error only happens when the group has more than about 120 members. For a group with 110 members it works fine.
>
> Does anybody know what could be going on?
>
> I understand that JCIFS does not support fragmented *request* PDUs, but as far as I know we are not creating any fragmentation for the requests.

Hi Anton,

SID.getGroupMemberSids0 calls resolveSids with the array of SIDs to
get names for. That results in an MsrpcLookupSids call with an array
in it which if large enough could exceed the DCERPC fragment size. So
basically calling SID.getGroupMemberSids with the
SID.SID_FLAG_RESOLVE_SIDS flag is not fully supported - not for groups
with large membership. Of course if you didn't use the
SID.SID_FLAG_RESOLVE_SIDS flag it would work.

Note that I think you could work around this by adding a bit of
initialization code that populates the SID cache by resolving common
SIDs in smaller chunks. Subsequent calls to resolveSids will then not
result in large request PDUs because most of the SID data will come
from the cache. But this is of course a major kludge.

The proper solution would be to just implement fragmented request
PDUs. But as I'm sure you are aware, JCIFS development is very limited
so this is not likely to happen. I would very much like to see JCIFS
support fragmented request PDUs, but I do not consider this issue to
be a serious error as resolving SIDs to names is not a primary
function of the library.

Mike

-- 
Michael B Allen
Java Active Directory Integration
http://www.ioplex.com/