"Request Header Or Cookie Too Large" when logging into the NSX UI using an LDAP account
Article ID: 314291
Updated On:
Products
Issue/Introduction
- Logging into the NSX UI using an LDAP user with a large number of groups fails with the error:
400 Bad Request: Request Header Or Cookie Too Large - nginx
Logging into the NSX manager UI with a local user account has no issue and succeeds.
The LDAP user is a member of a large number of LDAP groups.
In the NSX manager log /var/log/syslog you can see the login attempt:
NSX 2987 SYSTEM [nsx@6876 audit="true" comp="nsx-manager" level="INFO" splitId="######" splitIndex="1 of 2" subcomp="http"] UserName="LdapUserDetailsImpl [Dn=CN=<username>,OU=######,DC=##,DC=####,DC=####,DC=####; Username=<username>@<domain>; Password=[PROTECTED]; Enabled=true; AccountNonExpired=true; CredentialsNonExpired=true; AccountNonLocked=true; Granted Authorities=[<array of gropups>]
...
NSX 773180 SYSTEM [nsx@6876 audit="true" comp="nsx-manager" level="INFO" splitId="######" splitIndex="2 of 2" subcomp="http"] [<array of gropups>]
Depending on the number of groups, there may be more than 2 splitIndex entries.
You can count the number of groups from both splitIndex to see how many groups the user is a member of.
Environment
Cause
This is a known issue affecting VMware NSX.
When LDAP authentication is configured and a user is a member of many LDAP groups, the x-nsx-groups header might exceed nginx's default buffer size of 8k, which occurs when the LDAP user is associated with a large number of groups typically over 100 to 500 or greater.
Resolution
In VMware NSX-T 3.1.1, the header size allowed has been increased to 32KB, if the header size is larger than 32KB, the issue can still occur.
In VMware NSX 4.2, the process for validating the groups an LDAP user is a member of, has been optimized, therefore the issue should not occur again. To avoid and resolve the issue, it is recommended to upgrade to NSX 4.2.0 or above.
Recommended version can be found here NSX Pre-upgrade tasks.
Feedback
