> Source: [sk182959](https://support.checkpoint.com/results/sk/sk182959)

# sk182959 - Identity Awareness user authentication using Active Directory fails when AD username is longer than 20 characters

| Property | Value |
|----------|-------|
| Solution ID | sk182959 |
| Date Created | 2025-01-06 |
| Last Modified | 2025-01-08 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS) |

## Symptoms

- * A user cannot authenticate using Activity Directory credentials to access resources located behind an Identity Awareness Gateway.
* The user's Active Directory username is longer than 20 characters.
* In an Identity Conciliation configuration, the Policy Decision Point (PDP) Gateway receives the user's identity from Active Directory. The PDP Gateway then forwards the user's identity to the Policy Enforcement Point (PEP) Gateway. The PEP Gateway receives the user's identity from the PDP. However, a packet capture of traffic leaving the PEP Gateway shows that it does not send communication packets to the PDP to fetch group membership information for the user.
* In an Identity Conciliation configuration, these error messages may appear in the logs of the PDP Gateway:

  ```
  
  ldap_async_do_search: Error: ldap_search_ext
  OPSEC_ldap_search: do search failure
  ```

## Cause

Due to a known limitation in Active Directory, a username that is longer than 20 characters does not work with Check Point Identity Awareness. For more information, see [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/active-directory-domain-services-maximum-limits).

## Solution

This is an issue with Microsoft Active Directory. This is not a Check Point issue.  

To resolve the issue:   
In the Active Directory Account Settings, make the usernames of the affected users shorter than 20 characters.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content