kdb5_util dump gives Server error

Question

I have been trying to dump my Kerberos database (ldap backend) using kdb5_util dump (filename), but I get:

kdb5_util load_dump version 6
kdb5_util: error performing Kerberos version 5 release 1.8 dump (Server error)
policy  default    0       0       1       1       1       0       0       0       0

Kerberos KDC and Kadmin log has nothing, ldap.log gives May 31 12:40:17 kdc slapd[28020]: connection_input: conn=1091 deferring operation: binding

Everything else works fine, creating, deleting, authentication of principals, no problem. Just dumping the DB fails. As far as I understand, the backend should not have any influence on the dump.

Any ideas how I can debug or fix this? What am I missing?

/etc/krb5.conf

[libdefaults]
        default_realm   = REALM.EXAMPLE.COM
        kdc_timesync    = 1
        ccache_type     = 4
        forwardable     = true
        proxiable       = true

[realms]
        REALM.EXAMPLE.COM = {
                kdc             = kdc.realm.example.com
                admin_server    = kdc.realm.example.com
                kpasswd_server  = kdc.realm.example.com
        }

[domain_realm]
        .realm.example.com  = REALM.EXAMPLE.COM

/etc/krb5kdc/kdc.conf

[realms]
    REALM.EXAMPLE.COM = {
        default_domain  = realm.example.com
        database_module = ldapconf

        acl_file        = /etc/krb5kdc/kadm5.acl
        key_stash_file  = /etc/krb5kdc/.master

       max_life        = 10h 0m 0s
       max_renewable_life = 7d 0h 0m 0s

        master_key_type         = aes256-cts
        supported_enctypes      = aes256-cts-hmac-sha1-96:normal
#aes128-cts-hmac-sha1-96:normal arcfour-hmac:normal
        default_principal_flags = +preauth

        pkinit_identity = FILE:/etc/krb5kdc/kdc-cert.pem,/etc/krb5kdc/.kdc-key.pem
        pkinit_anchors  = FILE:/etc/krb5kdc/ca-cert.pem

        dict_file       = /root/bad_passwords.dict
    }

[dbmodules]
        ldapconf = {
                db_library                 = kldap
                ldap_kerberos_container_dn = "cn=kerberos,dc=realm,dc=example,dc=com"
                ldap_kdc_dn                = "cn=kerberos-kdc,dc=realm,dc=example,dc=com"
                ldap_kadmind_dn            = "cn=kerberos-admin,dc=realm,dc=example,dc=com"
                ldap_servers               = ldapi:///
                ldap_service_password_file = /etc/krb5kdc/.service
    }
[logging]
kdc          = FILE:/var/log/kerberos/kdc.log
admin_server = FILE:/var/log/kerberos/kadmin.log
default      = FILE:/var/log/kerberos/kerberos.log

Answer 1

Found the Problem after debugging at last:

The LDAP backend has a hard Size limit of 500 for search requests. With 501 Users that bit me in the backside!

Fix:

#
# remove sizelimit for ldap search
#
# apply with ldapmodify -Y EXTERNAL -H ldapi:/// -f sizelimit.ldif
#
dn: olcDatabase={1}hdb,cn=config
changetype: modify
add: olcLimits
olcLimits:  dn.exact="cn=kerberos-admin,dc=realm,dc=example,dc=com" size=unlimited

Apply, restart slapd, and dump happily away