Skip to main content
sshimpi
sshimpi
Gold ⭐️
December 25, 2016

Openldap with sync-ldap --groups does not work

  • October 5, 2026 at 9:31 AM
  • 0 replies
  • 886 views
  • Translate All

Problem Statement:

when doing an ambari-server sync-ldap -groups=<your file>

It will bring over the groups but not the users in it.

ROOT CAUSE: When troubleshooting why the group members are not being sync'd with FreeIPA, a packet trace helped identify the issue. With ActiveDirectory the user's DN is exposed as an attribute: "distinguishedName", this is not the case inFreeIPA/RHEL IDM (using 389 DS for the directory server implementation). The DN is not an attribute on the user, and cannot be used in a filter like this:

(&(objectClass=posixaccount)(|(dn=uid=dstreev,cn=users,cn=accounts,dc=hdp,dc=local)(uid=uid=dstreev,cn=users,cn=accounts,dc=hdp,dc=local)))

If we want to retrieve a specific object by DN we have to set the DN as the search base and do a base search scope.

ldapsearch -H ldap://ad.hortonworks.local:389 -x -D "CN=hadoopsvc,CN=Users,dc=hortonworks,dc=local" -W -b "CN=paul,CN=Users,DC=hortonworks,DC=local" -s base -a always "(objectClass=user)"

In this case I'm looking for the user with DN: CN=paul,CN=Users,DC=hortonworks,DC=local. My bind user is hadoopsvc, and because this is AD my objectClass is user.

RESOLUTION: This is a known bug: https://hortonworks.jira.com/browse/BUG-45536 (this link is an internal Hortonworks link and it's published here for reference purposes)

There is no workaround, this is fixed in 2.1.3 version of ambari, per the bug.

    Terms & ConditionsAccessibility statement