> Source: [sk183799](https://support.checkpoint.com/results/sk/sk183799)

# sk183799 - Access Role Rules Fail for Users with Distinguished Name Longer Than 512 Bytes

| Property | Value |
|----------|-------|
| Solution ID | sk183799 |
| Date Created | 2025-08-19 |
| Last Modified | 2025-08-21 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * End users who authenticate using Active Directory credentials cannot locate resources located behind a Policy Enforcement Point (PEP) Security Gateway. The Policy Decision Point (PDP) Security Gateway does not match Active Directory Users to access roles.
* The problem occurs only for Active Directory users with a Distinguished Name (DN) length greater than 512 bytes. Users with DN length less than or equal to 512 bytes are identified correctly, and the PEP Gateway enforces policy as expected.
* On the CLI of the Policy Decision Point (PDP) Security Gateway, the *$FWDIR/log/pdpd.elg* file shows:   

  ```
  [worker_0][AUTH (TD::Surprise)] pdp::UserWithDomainWrapper::Init: user name len is bigger than max of: 512
  ```

## Cause

The PDP Gateway cannot process Active Directory users with DN length greater than 512 bytes.

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue. **After you install the hotfix, you must manually increase the allowed DN length on the relevant PDP Gateway(s).**

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member / Security Group involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

**Instructions to manually increase the allowed DN length after hotfix installation:**   

1. Connect to the CLI of the relevant PDP Gateways via SSH.  
   In a clsuter configuration, connect to all cluster members.  
   In a VSX configuration, run: `vsenv <vsid>`
2. Enter the Expert Mode.
3. Run:   
   `pdp auth distinguished_name_length set 1000`

**Note:** The `distinguished_name_length `attribute is available only after hotfix installation. This attribute can be set only to `512` or to `1000`.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content