Impossible to map LDAP groups if remote server's query limit is reached

Active Directory will only return a certain number of results for an LDAP query. This means that the external role mapping UI will not show all available groups in the drop list box.

In Nexus 2.x there are workarounds to this problem as documented here:

Nexus does not list all avaliable LDAP groups in external role mapping dialog

In Nexus 3 the external role mapping is done via a non-editable drop-list control. So there is no workaround, if the LDAP group you need isn't in the list it cannot be mapped.