**Problem:** 
Some AD users can't log in, they get the error:
`Authentification failed: password is incorrect or there is no user with such name`

Clickhouse version 22.3.2.1

**There is an error in Clickhouse logs:**
`<Error> Access(user directories): from: 10.11.12.13, user: AD_USERNAME: Authentification failed: Code: 532. DB::Exception: Size limit exceeded. (LDAP_ERROR)`

This error occurs for AD users who have many groups in the **memberOf** LDAP container.

**I checked the number of groups for 4 accounts:**

AD_USERNAME_1 - 107 groups - ERROR Authentification failed
AD_USERNAME_2 - 120 groups - ERROR Authentification failed
AD_USERNAME_3 - 54   groups - OK
AD_USERNAME_4 - 38   groups - OK

**I checked the search groups through the Ldapsearch program:**

Ldapsearch gave all 107 groups for the account without errors:
`ldapsearch -H "ldaps://hostname:636" -D 'CN=AD_USERNAME_1,OU=Users,DC=company,DC=corp.DC=net' -b 'DC=company,DC=corp.DC=net' '(&(objectClass=group)(member=CN=AD_USERNAME_1,OU=Groups,DC=company,DC=corp.DC=net))'`

**Probable cause of the error:** 
Clickhouse receives a list of groups which mapping from AD and cannot process a large string/array.
msgs = nullptr;
        }
    });
    diag(ldap_search_ext_s(handle, final_base_dn.c_str(), scope, final_search_filter.c_str(), attrs, 0, nullptr, nullptr, &timeout, params.search_limit, &msgs));
    for (
         auto * msg = ldap_first_message(handle, msgs);
         msg != nullptr;
         msg = ldap_next_message(handle, msg)
    )
    {
        switch (ldap_msgtype(msg))
        {
            case LDAP_RES_SEARCH_ENTRY:
            {
                
                if (boost::iequals("dn", search_params.attribute))
                {
                    BerElement * ber = nullptr;
                    SCOPE_EXIT({
                        if (ber)
                        {
                            ber_free(ber, 0);
                            ber = nullptr;
                        }
                    });
                    ::berval bv;
                    diag(ldap_get_dn_ber(handle, msg, &ber, &bv));
                    if (bv.bv_val && bv.bv_len > 0)
                        result.emplace(bv.bv_val, bv.bv_len);
                }