question Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab in Archives of Support Questions (Read Only)

New users created in AD not showing in ranger while clicking on "Users/Groups" tab

shyamshaw — Thu, 12 Jan 2017 20:40:25 GMT

Hi Team,

I have configured ranger with AD. I was able to see all the AD users in Ranger when clicked on "Users/Groups" tab for the first login but the newly created AD users are not showing or it is taking a long time to reflect in Ranger.

I want my AD users to be synced at the earliest. I followed https://docs.hortonworks.com/HDPDocuments/HDP2/HDP-2.3.2/bk_Ranger_Install_Guide/content/ranger-usersync_settings.html to configure AD with ranger.

I found https://community.hortonworks.com/questions/19289/ranger-usersync-didnt-fetching-users-and-groups-fr.html from community but it didn't helped much.

Any help would be highly appreciated.

Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab

frank93 — Thu, 12 Jan 2017 21:31:45 GMT

Hi,

could you check your "ranger.usersync.sleeptimeinmillisbetweensynccycle" parameter's value? It can be found in "Advanced ranger-ugsync-site" in Ambari. It's value is time in milliseconds between every sync cycle.

In usersync.log you can see your last sync time. Therefore you can determine the reason why the user is not added.

Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab

shyamshaw — Thu, 12 Jan 2017 21:36:05 GMT

Hi,

The current value for "ranger.usersync.sleeptimeinmillisbetweensynccycle" parameter is 60000. I tried to changed it to < 6000 but that too didn't helped.

My connection to AD server is working fine without any issues.

Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab

frank93 — Thu, 12 Jan 2017 21:40:07 GMT

Changing the value to <6000 causes the default value to be set, which is 1 min (which was also your previous value - 60000millis). Can you check in usersync.log if the sync is really happening?

Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab

frank93 — Thu, 12 Jan 2017 21:44:52 GMT

If your users and groups were synced for the first time, and now when you add user to AD he is not synced, the reason may be with your filter. Are you sure the user meets filter expression?

Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab

shyamshaw — Thu, 12 Jan 2017 21:59:05 GMT

I have set "ranger.usersync.ldap.user.searchfilter" to single empty space as mentioned in the document. Can you please point me to properties which I should focus on? I checked usersync.log but didn't find any specific error log.

I noticed that newly created users are getting synced but it is taking a long time.

usersync.log:

12 Jan 2017 08:06:59 INFO LdapUserGroupBuilder [UnixUserSyncThread] - Updating user count: 20, userName: test1, groupList: [] 12 Jan 2017 08:06:59 INFO LdapUserGroupBuilder [UnixUserSyncThread] - LDAPUserGroupBuilder.getUsers() completed with user count: 20 12 Jan 2017 08:07:00 INFO UserGroupSync [UnixUserSyncThread] - End: update user/group from source==>sink

Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab

frank93 — Thu, 12 Jan 2017 22:16:42 GMT

Newly created users should be synced during next synchronization which is 1 minute maximum in your case. If newly created user gets synced successfully, there is no problem in Ranger AD configuration. It seems that you have connection problems / delay with your AD server. What is the ping time when you do "ping ad-server-ip-address"? Try to ping your ad server with "-t 60" parameter, and observe if the connection is OK all the time.

Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab

frank93 — Thu, 12 Jan 2017 22:27:56 GMT

Please check also whether your ranger-ugsync-site.xml file contains proper value of sleeptimeinmillisbetweensynccycle parameter. The file should be here: /usr/hdp/current/ranger-usersync/conf

Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab

shyamshaw — Thu, 12 Jan 2017 22:37:01 GMT

I checked the value of sleeptimeinmillisbetweensynccycle parameter, and it is same (60000) as defined in ambari.

[root@master1 ~]# ping <ad-server-ip-address> -t 60

PING XXX.XX.XX.XX (XXX.XX.XX.XX) 56(84) bytes of data.

64 bytes from XXX.XX.XX.XX: icmp_seq=1 ttl=128 time=0.529 ms

64 bytes from XXX.XX.XX.XX: icmp_seq=2 ttl=128 time=0.525 ms

64 bytes from XXX.XX.XX.XX: icmp_seq=3 ttl=128 time=0.517 ms

64 bytes from XXX.XX.XX.XX: icmp_seq=4 ttl=128 time=0.429 ms

64 bytes from XXX.XX.XX.XX: icmp_seq=5 ttl=128 time=0.530 ms

64 bytes from XXX.XX.XX.XX: icmp_seq=6 ttl=128 time=0.474 ms

64 bytes from XXX.XX.XX.XX: icmp_seq=7 ttl=128 time=0.515 ms

Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab

frank93 — Thu, 12 Jan 2017 22:47:19 GMT

Could you provide me also the output of command:

ll /usr/bin/ | grep ranger-usersync

Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab

shyamshaw — Thu, 12 Jan 2017 23:00:04 GMT

[sbhdfs@master1 ~]$ ll /usr/bin/ | grep ranger-usersync

lrwxrwxrwx 1 root root 60 Jan 11 07:28 ranger-usersync -> /usr/hdp/current/ranger-usersync/ranger-usersync-services.sh

lrwxrwxrwx 1 root root 54 Dec 26 04:52 ranger-usersync-start -> /usr/hdp/current/ranger-usersync/ranger-usersync-start

lrwxrwxrwx 1 root root 53 Dec 26 04:52 ranger-usersync-stop -> /usr/hdp/current/ranger-usersync/ranger-usersync-stop

Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab

frank93 — Thu, 12 Jan 2017 23:51:44 GMT

Its ok. In usersync.log find last and first line of sync cycle and determine if the time difference equals the time you configured. Like here:

12 Jan 2017 16:44:33  INFO UserGroupSync [UnixUserSyncThread] - End: update user/group from source==>sink
12 Jan 2017 16:46:33  INFO UserGroupSync [UnixUserSyncThread] - Begin: update user/group from source==>sink

In my case its 2 mins. When you add a new user again, track your usersync.log whether your newly created user appears in the log file.

Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab

spolavarapu — Fri, 13 Jan 2017 02:49:27 GMT

@Shyam Shaw

Just want to clarify one thing - For AD/LDAP as the sync source, minimum allowed sync interval is 1hr. If you set the value for "ranger.usersync.sleeptimeinmillisbetweensynccycle" anything less than 1hr, it will be ignored and 1hr sync interval is used. Since add/update of users or groups in AD/LDAP server is not a frequent operation in most of the enterprise deployments, it is chosen to have minimum of 1hr sync interval. For Unix or File based sync, the minimum sync interval is 1min.

Either you can wait for 1hr for the next sync cycle to kick in and sync the new users/groups or restart usersync process.

Note:- Usersync process on restart will first get all the existing users, groups, and group memberships from ranger admin in order to build its local cache before doing any sync from AD. This can take long time depending on the size of the db tables for users, groups, and group memberships in ranger admin.

Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab

shyamshaw — Fri, 13 Jan 2017 11:46:11 GMT

Hi @spolavarapu,

Thanks for the detailed explanation. So, the "ranger.usersync.sleeptimeinmillisbetweensynccycle" property only applies to unix users and not LDAP/AD users. Is it correct?

Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab

spolavarapu — Fri, 13 Jan 2017 11:54:35 GMT

@Shyam Shaw, Not completely. For LDAP/AD users, this property will be used only when the value is >= 1hr. Anything that is <1hr is ignored and 1hr interval is used.

Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab

shyamshaw — Fri, 13 Jan 2017 11:56:56 GMT

@spolavarapu, thanks a lot!!!

Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab

frank93 — Fri, 13 Jan 2017 16:13:41 GMT

@spolavarapu @Shyam Shaw

In my case any user added in AD is synced every 2 minutes not 1hr. I am using HDP2.5 with Ranger 0.6.0. My test environment has got 2300 users.

Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab

shyamshaw — Fri, 13 Jan 2017 16:21:18 GMT

@Edgar Daeds @spolavarapu

I too using HDP 2.5 and ranger 0.6.0. my environment has only 30 users. It is taking around 40 minutes to sync the users.

Re: New users created in AD not showing in ranger while clicking on "Users/Groups" tab

spolavarapu — Tue, 17 Jan 2017 03:04:53 GMT

Can you provide the usersync logs? especially during startup of usersync