**Problem:** 
Some AD users can't log in, they get the error:
`Authentification failed: password is incorrect or there is no user with such name`

Clickhouse version 22.3.2.1

**There is an error in Clickhouse logs:**
`<Error> Access(user directories): from: 10.11.12.13, user: AD_USERNAME: Authentification failed: Code: 532. DB::Exception: Size limit exceeded. (LDAP_ERROR)`

This error occurs for AD users who have many groups in the **memberOf** LDAP container.

**I checked the number of groups for 4 accounts:**

AD_USERNAME_1 - 107 groups - ERROR Authentification failed
AD_USERNAME_2 - 120 groups - ERROR Authentification failed
AD_USERNAME_3 - 54   groups - OK
AD_USERNAME_4 - 38   groups - OK

**I checked the search groups through the Ldapsearch program:**

Ldapsearch gave all 107 groups for the account without errors:
`ldapsearch -H "ldaps://hostname:636" -D 'CN=AD_USERNAME_1,OU=Users,DC=company,DC=corp.DC=net' -b 'DC=company,DC=corp.DC=net' '(&(objectClass=group)(member=CN=AD_USERNAME_1,OU=Groups,DC=company,DC=corp.DC=net))'`

**Probable cause of the error:** 
Clickhouse receives a list of groups which mapping from AD and cannot process a large string/array.
else if (tls_require_cert_lc_str == "allow")
            params.tls_require_cert = LDAPClient::Params::TLSRequireCert::ALLOW;
        else if (tls_require_cert_lc_str == "try")
            params.tls_require_cert = LDAPClient::Params::TLSRequireCert::TRY;
        else if (tls_require_cert_lc_str == "demand")
            params.tls_require_cert = LDAPClient::Params::TLSRequireCert::DEMAND; 
        else
            throw Exception("Bad value for 'tls_require_cert' entry, allowed values are: 'never', 'allow', 'try', 'demand'", ErrorCodes::BAD_ARGUMENTS);
    }
    if (has_tls_cert_file)
        params.tls_cert_file = config.getString(ldap_server_config + ".tls_cert_file");
    if (has_tls_key_file)
        params.tls_key_file = config.getString(ldap_server_config + ".tls_key_file");
    if (has_tls_ca_cert_file)
        params.tls_ca_cert_file = config.getString(ldap_server_config + ".tls_ca_cert_file");
    if (has_tls_ca_cert_dir)
        params.tls_ca_cert_dir = config.getString(ldap_server_config + ".tls_ca_cert_dir");
    if (has_tls_cipher_suite)
        params.tls_cipher_suite = config.getString(ldap_server_config + ".tls_cipher_suite");
    if (has_port)
    {
        const auto port = config.getInt64(ldap_server_config + ".port");
        if (port < 0 || port > 65535)
            throw Exception("Bad value for 'port' entry", ErrorCodes::BAD_ARGUMENTS);
        params.port = port;
    }
    else
        params.port = (params.enable_tls == LDAPClient::Params::TLSEnable::YES ? 636 : 389);
}
void parseKerberosParams(GSSAcceptorContext::Params & params, const Poco::Util::AbstractConfiguration & config)