Repository: hashicorp/vault (Go)

Issue:
Regression 1.13.2: "no LDAP groups found in groupDN"
This is a regression after upgrading 1.13.1 to 1.13.2.

We have LDAP authentication configured against AD, using this groupfilter:

"(&(objectClass=group)(member:1.2.840.113556.1.4.1941:={{.UserDN}}))

Login still works, but we get an error in the Web UI:

"no LDAP groups found in groupDN [...] only policies from locally-defined groups available".  The token then won't get any LDAP-related policies attached.

Downgrading to 1.13.1 fixes the issue.



Discussion:
Same issue after upgrading to 1.12.6. Temporary workaround: `max_page_size=-1`
Same issue here, fixed by disabling pagination (-1) against FreeIPA / Redhat Identity.
Same issue Symas OpenLDAP
We appreciate you notifying us of this issue. You can find more information about the issue and the proposed fix at https://github.com/hashicorp/vault/pull/20453. Meanwhile, as a temporary solution, you can manually set the `max_page_size` configuration option instead of relying on the default behavior.
I'm back in by setting the max_page_size to -1, cheers.
> We appreciate you notifying us of this issue. You can find more information about the issue and the proposed fix at #20453. Meanwhile, as a temporary solution, you can manually set the `max_page_size` configuration option instead of relying on the default behavior.

Where do you set this parameter Exactly, as a workaround?
I used this command:
```
vault write auth/ldap/config max_page_size=-1
```
> I used this command:
> 
> ```
> vault write auth/ldap/config max_page_size=-1
> ```

This works great for me as well, same issue as others, 1.13.2
Glad there’s a pr for this.

> vault write auth/ldap/config max_page_size=-1

Worked great!
Using `v1.13.2` with symas openldap 
We ran into this as well using Active Directory. Definitely a bad bug
I have the same issue and the workaround paging does not work for me.
Well, we run into this as well with Red Hat Directory Server as a backend.

**As all of our policies are bind to LDAP/external groups and as we followed the best practice to revoke the root token this basically closed us out from our Vault cluster!!!**

Now we can test our recovery token procedure (I hope enough people will have their part of the recovery key as well as the gpg keys to decrypt it...)

UPDATE: our recovery token procedure worked and setting the `max_page_size=-1` helped
> **As all of our policies are bind to LDAP/external groups and as we followed the best practice to revoke the root token this basically closed us out from our Vault cluster!!!**

Why not just rollback? I use auto-unseal keys, I just needed to roll back to 1.13.1 and it all came back just fine.
@Cajga you can always generate a new root token using unseal tokens: https://developer.hashicorp.com/vault/tutorials/operations/generate-root
> Now we can test our recovery token procedure (I hope enough people will have their part of the recovery key as well as the gpg keys to decrypt it...)

I just rolled back...




Patch:
diff --git a/changelog/20453.txt b/changelog/20453.txt
new file mode 100644
index 00000000000..e605791bc6b
--- /dev/null
+++ b/changelog/20453.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+auth/ldap: Set default value for `max_page_size` properly
+```
diff --git a/sdk/helper/ldaputil/client.go b/sdk/helper/ldaputil/client.go
index 470de59f1eb..c3562a5d406 100644
--- a/sdk/helper/ldaputil/client.go
+++ b/sdk/helper/ldaputil/client.go
@@ -553,7 +553,7 @@ func (c *Client) GetLdapGroups(cfg *ConfigEntry, conn Connection, userDN string,
 	if cfg.UseTokenGroups {
 		entries, err = c.performLdapTokenGroupsSearch(cfg, conn, userDN)
 	} else {
-		if paging, ok := conn.(PagingConnection); ok && cfg.MaximumPageSize >= 0 {
+		if paging, ok := conn.(PagingConnection); ok && cfg.MaximumPageSize > 0 {
 			entries, err = c.performLdapFilterGroupsSearchPaging(cfg, paging, userDN, username)
 		} else {
 			entries, err = c.performLdapFilterGroupsSearch(cfg, conn, userDN, username)
diff --git a/sdk/helper/ldaputil/config.go b/sdk/helper/ldaputil/config.go
index 0313817aedf..dfa34daddfd 100644
--- a/sdk/helper/ldaputil/config.go
+++ b/sdk/helper/ldaputil/config.go
@@ -9,7 +9,6 @@ import (
 	"encoding/pem"
 	"errors"
 	"fmt"
-	"math"
 	"strings"
 	"text/template"
 
@@ -255,8 +254,8 @@ Default: ({{.UserAttr}}={{.Username}})`,
 
 		"max_page_size": {
 			Type:        framework.TypeInt,
-			Description: "The maximum number of results to return for a single paged query. If not set, the server default will be used for paged searches. A requested max_page_size of 0 is interpreted as no limit by LDAP servers. If set to a negative value, search requests will not be paged.",
-			Default:     math.MaxInt32,
+			Description: "If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control to request pages of up to the given size. This can be used to avoid hitting the LDAP server's maximum result size limit. Otherwise, the LDAP backend will not use the paged search control.",
+			Default:     0,
 		},
 	}
 }
diff --git a/website/content/api-docs/auth/ldap.mdx b/website/content/api-docs/auth/ldap.mdx
index ccb42faf34c..ba514d2f3e5 100644
--- a/website/content/api-docs/auth/ldap.mdx
+++ b/website/content/api-docs/auth/ldap.mdx
@@ -35,8 +35,8 @@ This endpoint configures the LDAP auth method.
   names will be normalized to lower case. Case will still be preserved when
   sending the username to the LDAP server at login time; this is only for
   matching local user/group definitions.
-- `connection_timeout` `(integer: 30 or string: "30s")` - Timeout, in seconds, 
-  when attempting to connect to the LDAP server before trying the next URL in 
+- `connection_timeout` `(integer: 30 or string: "30s")` - Timeout, in seconds,
+  when attempting to connect to the LDAP server before trying the next URL in
   the configuration.
 - `request_timeout` `(integer: 90 or string: "90s")` - Timeout, in seconds, for
   the connection when making requests against the server before returning back
@@ -97,11 +97,10 @@ This endpoint configures the LDAP auth method.
 - `dereference_aliases` `(string: never)` - When aliases should be dereferenced
   on search operations. Accepted values are 'never', 'finding', 'searching',
   'always'. Defaults to 'never'.
-- `max_page_size` `(int: math.MaxInt32)` - If set to a value greater than 0, the LDAP
+- `max_page_size` `(int: 0)` - If set to a value greater than 0, the LDAP
   backend will use the LDAP server's paged search control to request pages of
   up to the given size. This can be used to avoid hitting the LDAP server's
-  maximum result size limit. A value of 0 will be interpreted by the LDAP
-  server as unlimited. If set to -1, the LDAP backend will not use the
+  maximum result size limit. Otherwise, the LDAP backend will not use the
   paged search control.
 
 @include 'tokenfields.mdx'
diff --git a/website/content/docs/auth/ldap.mdx b/website/content/docs/auth/ldap.mdx
index cabb3769eb4..1e515d48058 100644
--- a/website/content/docs/auth/ldap.mdx
+++ b/website/content/docs/auth/ldap.mdx
@@ -156,7 +156,7 @@ Use `vault path-help` for more details.
 ### Other
 
 - `username_as_alias` (bool, optional) - If set to true, forces the auth method to use the username passed by the user as the alias name.
-- `max_page_size` (int, optional) - The maximum number of results to return for a single LDAP query. This is useful for preventing large queries from being run against the LDAP server. The default is the maximum value for an int32.
+- `max_page_size` (int, optional) - If set to a value greater than 0, the LDAP backend will use the LDAP server's paged search control to request pages of up to the given size. This can be used to avoid hitting the LDAP server's maximum result size limit. Otherwise, the LDAP backend will not use the paged search control.
 
 ## Examples:
 
diff --git a/website/content/docs/upgrading/upgrade-to-1.11.x.mdx b/website/content/docs/upgrading/upgrade-to-1.11.x.mdx
index e9d70c35899..f288e7af1a9 100644
--- a/website/content/docs/upgrading/upgrade-to-1.11.x.mdx
+++ b/website/content/docs/upgrading/upgrade-to-1.11.x.mdx
@@ -27,4 +27,19 @@ API path by setting the [bool config option](/vault/api-docs/secret/databases/el
 
 @include 'raft-retry-join-failure.mdx'
 
-@include 'tokenization-rotation-persistence.mdx'
\ No newline at end of file
+@include 'tokenization-rotation-persistence.mdx'
+
+### LDAP Pagination Issue
+
+There was a regression introduced in 1.11.10 relating to LDAP maximum page sizes, resulting in
+an error `no LDAP groups found in groupDN [...] only policies from locally-defined groups available`.  The issue
+occurs when upgrading Vault with an instance that has an existing LDAP Auth configuration.
+
+As a workaround, disable paged searching using the following:
+```shell-session
+vault write auth/ldap/config max_page_size=-1
+```
+
+#### Impacted Versions
+
+Affects Vault 1.11.10.
diff --git a/website/content/docs/upgrading/upgrade-to-1.12.x.mdx b/website/content/docs/upgrading/upgrade-to-1.12.x.mdx
index ede60be52da..7cd1387e14f 100644
--- a/website/content/docs/upgrading/upgrade-to-1.12.x.mdx
+++ b/website/content/docs/upgrading/upgrade-to-1.12.x.mdx
@@ -152,7 +152,7 @@ It will produce errors in Vault Server's logs such as:
   error=
   | 1 error occurred:
   | 	* panic generating audit log
-  | 
+  |
 ```
 
 As a workaround, [listing plugins by type](/vault/api-docs/system/plugins-catalog#list-plugins-1)
@@ -184,3 +184,18 @@ Affects version 1.12.3. A fix will be released in 1.12.4.
 @include 'tokenization-rotation-persistence.mdx'
 
 @include 'ocsp-redirect.mdx'
+
+### LDAP Pagination Issue
+
+There was a regression introduced in 1.12.6 relating to LDAP maximum page sizes, resulting in
+an error `no LDAP groups found in groupDN [...] only policies from locally-defined groups available`.  The issue
+occurs when upgrading Vault with an instance that has an existing LDAP Auth configuration.
+
+As a workaround, disable paged searching using the following:
+```shell-session
+vault write auth/ldap/config max_page_size=-1
+```
+
+#### Impacted Versions
+
+Affects Vault 1.12.6.
diff --git a/website/content/docs/upgrading/upgrade-to-1.13.x.mdx b/website/content/docs/upgrading/upgrade-to-1.13.x.mdx
index aa97f70fcf5..764a0f85044 100644
--- a/website/content/docs/upgrading/upgrade-to-1.13.x.mdx
+++ b/website/content/docs/upgrading/upgrade-to-1.13.x.mdx
@@ -107,6 +107,20 @@ accommodates the default minimum duration of an STS token and overrides the defa
 
 Affects Vault 1.13.0 only.
 
+### LDAP Pagination Issue
+
+There was a regression introduced in 1.13.2 relating to LDAP maximum page sizes, resulting in
+an error `no LDAP groups found in groupDN [...] only policies from locally-defined groups available`.  The issue
+occurs when upgrading Vault with an instance that has an existing LDAP Auth configuration.
+
+As a workaround, disable paged searching using the following:
+```shell-session
+vault write auth/ldap/config max_page_size=-1
+```
+
+#### Impacted Versions
+
+Affects Vault 1.13.2.
 
 ### PKI Cross-Cluster Revocation Requests and Unified CRL/OCSP
 


Test patch:
diff --git a/sdk/helper/ldaputil/config_test.go b/sdk/helper/ldaputil/config_test.go
index 1fd96385c3e..b7fd22ccbb2 100644
--- a/sdk/helper/ldaputil/config_test.go
+++ b/sdk/helper/ldaputil/config_test.go
@@ -175,7 +175,7 @@ var jsonConfigDefault = []byte(`
   "request_timeout": 90,
   "connection_timeout": 30,
   "dereference_aliases": "never",
-  "max_page_size": 2147483647,
+  "max_page_size": 0,
   "CaseSensitiveNames": false,
   "ClientTLSCert": "",
   "ClientTLSKey": ""