Issue Summary

When AD returns range attribute for group members, Crowd will fetch further ranges without transaction. This can result in using different connections for different ranges. When Crowd is connected to load balancer it is possible that Crowd will receive subsequent pages from different nodes. AD nodes can use different sorting on attributes, and this can lead to inconsistency in groups.

Potential solution would be to use transactions for fetching subsequent pages with attributes. Thanks to that the same connection will be reused for each of requests.

Steps to Reproduce

1. Create AD cluster
2. Use round robin load balancer
3. Have a group with >1500 members
4. Run synchronisation

Expected Results

Crowd correctly synchronises memberships.

Actual Results

Crowd can miss some of AD memberships.

Workaround

Workaround is to implement stickiness on load balancer so that Crowd will always hit the same AD node if it's present.