question Re: Ranger users who were synced from AD aren't mapped with Group in Support Questions

Ranger users who were synced from AD aren't mapped with Group

JiHoone — Tue, 06 Aug 2024 00:49:58 GMT

I'm wondering why the users are not mapped to the AD group as shown below.

These are my configurations in Ranger.

* COMMON CONFIGS

LDAP/AD URL : ldap://myADIp:389

Bind User: cn=admin,ou=ou1,dc=dc1,dc=dc2,dc=dc3

Incremental Sync: Yes

Enable LDAP STARTTLS: No

* USER CONFIGS

Username Attribute: sAMAccountName

User Object Class: user

User Search Base: ou=ou1,dc=dc1,dc=dc2,dc=dc3

User Search Filter: (empty)

User Search Scope: sub

User Group Name Attribute: memberof,ismemberof

Group User Map Sync: Yes

* GROUP CONFIGS

Group Member Attribute: member

Group Name Attribute: cn

Group Object Class: group

Group Search Base: ou=ou1,dc=dc1,dc=dc2,dc=dc3

Group Search Filter: (empty)

Enable Group Search First: No

Sync nested Groups: No

I would appreciate if you answer to me about this.

Thanks.

Re: Ranger users who were synced from AD aren't mapped with Group

Scharan — Tue, 06 Aug 2024 02:57:54 GMT

@JiHoone Can you try changing

User Group Name Attribute: memberof,ismemberof

User Group Name Attribute: memberof

Re: Ranger users who were synced from AD aren't mapped with Group

JiHoone — Tue, 06 Aug 2024 03:59:38 GMT

Hi @Scharan,

I changed the config, and then restarted the Ranger.

But it is still same...

Re: Ranger users who were synced from AD aren't mapped with Group

cloude — Tue, 06 Aug 2024 06:25:16 GMT

@JiHoone

Can you update this configuration ranger.usersync.ldap.referral=Follow

Re: Ranger users who were synced from AD aren't mapped with Group

vipindast — Tue, 06 Aug 2024 11:04:07 GMT

Hi @JiHoone

Group User Mapping: Ensure that the attributes used for mapping users to groups (memberof,ismemberof) are correct and present in your AD schema. Sometimes, different attributes might be used, so double-check with your AD schema.

Group Member Attribute: Ensure that the member attribute is correctly populated in your AD for the groups.

Re: Ranger users who were synced from AD aren't mapped with Group

JiHoone — Tue, 06 Aug 2024 13:38:41 GMT

Hi @cloude,

I changed 'ranger.usersync.ldap.referral' from 'ignore' to 'follow'.

But it still doesn't work..

Thanks.