Active Directory sets a max page size by default of 1000 entries.  I’m seeing my READ_ONLY LDAP connection only ever returning a maximum of 1000 groups from LDAP .  Is it supposed to support pagination?

The method seeing this limit is in GroupLDAPFederationMapper.java:

public UserFederationSyncResult syncDataFromFederationProviderToKeycloak() {

LDAPQuery.java method

public List<LDAPObject> getResultList() {

Calls LDAPQuery.java fetchQueryResults()

Which has this condition to check for pagination:

if (getConfig().isPagination() && identityQuery.getLimit() > 0) {

I have pagination set to True, but the identityQuery has a limit set to 0, so it never enters the pagination branch. Am I missing something about how to configure the group mapper to support pagination to fetch  more than 1000 entries?   

What this causes right now is for Keycloak to not see a user as a member of a group that they are a member of because many groups beyond the 1000 have not been synchronized into Keycloak.

I wonder if it would be better to support a Just-in-Time synchronization of just the groups that users are members of rather than syncing all groups and trying to do a union between the user groups and LDAP groups?  I’d love to not have every group in the system anyhow as it gets really unwieldy in the UI.