question Re: Ranger UserSync Issue - LDAP in Archives of Support Questions (Read Only)

Ranger UserSync Issue - LDAP

shashant_panwar — Tue, 28 Mar 2017 02:37:07 GMT

Hi,

I have Ranger UserSync enabled with LDAP. Everything was fine until I added a new user in LDAP. After adding, I am unable to find the user in Ranger. I tried restarting user-sync multiple times but no success.

I checked LDAP using search filters and the user exists with correct details. Any suggestions for debugging this issue or has anyone faced something like this in past?

Nothing helpful in ranger/user-sync & ranger/admin logs. Looks like users with groups are added. I see logs from "LdapUserGroupBuilder" class.

Re: Ranger UserSync Issue - LDAP

vperiasamy — Tue, 28 Mar 2017 03:07:45 GMT

Can you try adding groups to this user?

Enable debug and see if there are any logs in usersync or admin logs. If possible, share the configs like ldap search filters and search base.

Re: Ranger UserSync Issue - LDAP

shashant_panwar — Tue, 28 Mar 2017 03:08:05 GMT

Update -- I got the new users by disabling "Group Search First" and "Enable User Search".

Although, I would like to know what the difference between them and how exactly Ranger UserSync syncs users and group. Thank you!

Re: Ranger UserSync Issue - LDAP

vperiasamy — Tue, 28 Mar 2017 03:10:17 GMT

If you enable Group search first, usersync starts with syncing groups and bringing in users belonging to those groups (of course with your filter settings). Most likely this new user did not have any groups (for your filter), so did not get sync'ed.

Re: Ranger UserSync Issue - LDAP

shashant_panwar — Tue, 28 Mar 2017 03:10:23 GMT

@vperiasamy - Check my update. I believe the problem was "Users not belonging to a group". But, I did not understand why only users with groups were pulled. I would love to know the details if someone has an explanation how Ranger UserSync works.

Re: Ranger UserSync Issue - LDAP

shashant_panwar — Tue, 28 Mar 2017 03:29:52 GMT

@vperiasamy -- Agree, that's what I understood hard way 🙂 I though Ranger will sync groups with users as well as users without groups.

So should I disable group search first and keep user & user-group mapping. Any suggestions?