Ldap Synchronization Connector

When performing a LDAP search on the base DN which is the root naming context of an AD server (at least on 2003), search responses come accompanied with a referral. This is some AD specific setup. LSC currently raises an exception in such a case.

With JNDI configured to "ignore" referrals, a PartialResultsException is thrown. Catching it is pointless, since we then don't have the search response anywhere.

With JNDI configured to "follow" referrals, every search result makes JNDI perform at least one other search, although an entry has already been returned as a search result. This has a HUGE performance hit. Plus, many AD domains are badly configured, and the referral cannot always be followed (DNS resolution problems).

This seems to be a common problem. It is described here: https://mail.internet2.edu/wws/arc/shibboleth-users/2008-06/msg00044.html. Solving it is important to use AD fully. A quick workaround is to base searches on a sub-container in AD (for example ou=a,dc=ad,dc=lan).

To workaround this, it seems the best solution is to set referral handling to "throw", and catch referrals then skip them, as decribed here: http://java.sun.com/products/jndi/tutorial/ldap/referral/throw.html.