Return
-
Title
QAS and the implications of kerberos token bloat -
Description
Users being in a large number of groups causes the following errors:
The kerberos SSPI package generated an output token of size 12106 bytes, which was too large to fit in the token buffer of size 12000 bytes, provided by process id 4.
-
Cause
This is a Windows issue and not a QAS one. This is a hard Windows limit and there really isn't anything that can be done except take them out of groups. -
Resolution
Minimize the number of groups a user belongs to
-
Additional Information
Increasing the limitation in Active Directory will not negatively impact Authentication Services.