Invalid value for `dn`, length must be less than or equal to `255`

[rajendraindukuri]

Hi ,

In isi_sdk, I see a validation for group name to be less than equal to 255.

When we pass a group name with length equal to '255' , it throws the error Invalid value for dn, length must be less than or equal to 255

It is allowing max of 228 characters in spite of the max limit being 255. Any reason why this is happening? We have a test case for this and it is failing. Can you please help us understand this?

Please find below screenshot for reference:

Thanks
Rajendra

[tucked]

Which API are you calling? Also, what version of the SDK are you using?

[tucked]

It is allowing max of 228 characters in spite of the max limit being 255. Any reason why this is happening? We have a test case for this and it is failing. Can you please help us understand this?

I believe this is because group names are capped at 255 characters; however, dn (distinguished name), which contains the group name and some other info, is also capped at 255 characters.

How long is your cluster name? A dn could look like this e.g. for the built-in Administrators group:

CN=Administrators,CN=Builtin,DC=CLUSTER-FOO

If a 228-character group name in such a dn avoids this issue but a 229-character name does not, that could suggest the cluster name is 9 characters long:

>>> 255 - len("CN=,CN=Builtin,DC=123456789")
228

• (That may not be the case for groups from other auth providers, though.)

This probably shouldn't happen. The SDK verifies that the dn returned by the cluster is 255 characters or less (the PAPI-advertised limit):

isilon_sdk_python/isi_sdk_9_0_0/isi_sdk_9_0_0/models/auth_group_extended.py

Lines 128 to 129 in a371f43

	if dn is not None and len(dn) > 255:
	raise ValueError("Invalid value for `dn`, length must be less than or equal to `255`") # noqa: E501

If that error is raised, that means the cluster returned a dn longer than the advertised limit!
I have filed a product bug internally to address this.

[rajendraindukuri]

Hi @tucked ,

Thanks for the info and raising the bug for the same. Providing more details about the case:

Group name string being tested: "ansible-maxlength-group-kdjvcbfehjjhefbjcfbjkvbfkvhnjfenvjknfjfjknvkjfenvkenkrvknrkvgdghjvcbfehjjhefbjcfbjkvbfkvhnjfenvjknfjfjknvkjfenvkenkrvknrkvgdghjvcbfehjjhefbjcfbjkvbfkvhnjfenvjknfjfjknvkjfenvkenkrvknrkvjcfbjkvbfkvhnjfenvjknfjfjknvkjfenvkenkrvknrkvoo" (255 characters)

API used: AuthApi
Scenario being tested: Creating a group with 255 characters. Group is getting created in oneFs but throws an error while setting the 'dn'
SDK used: isi-sdk-9-0-0
Auth provider info: We created an access zone 'sample-zone' and it maps to LOCAL provider "LOCAL: sample-zone"
Cluster name details: 10 characters long

Please let us know when this gets fixed.

Thanks
Rajendra

[nalinkanwar]

Closing this since this is not an SDK issue; Issue is taken care of as part of internal bug tracking. This Issues page is for SDK related issues only.

[tucked]

This is fixed in OneFS v9.4.0.0+.