Community Articles

Find and share helpful community-sourced technical articles.
Celebrating as our community reaches 100,000 members! Thank you!
Labels (1)
Super Guru

Problem Statement:

when doing an ambari-server sync-ldap -groups=<your file>

It will bring over the groups but not the users in it.

ROOT CAUSE: When troubleshooting why the group members are not being sync'd with FreeIPA, a packet trace helped identify the issue. With ActiveDirectory the user's DN is exposed as an attribute: "distinguishedName", this is not the case inFreeIPA/RHEL IDM (using 389 DS for the directory server implementation). The DN is not an attribute on the user, and cannot be used in a filter like this:


If we want to retrieve a specific object by DN we have to set the DN as the search base and do a base search scope.

ldapsearch -H ldap://ad.hortonworks.local:389 -x -D "CN=hadoopsvc,CN=Users,dc=hortonworks,dc=local" -W -b "CN=paul,CN=Users,DC=hortonworks,DC=local" -s base -a always "(objectClass=user)"

In this case I'm looking for the user with DN: CN=paul,CN=Users,DC=hortonworks,DC=local. My bind user is hadoopsvc, and because this is AD my objectClass is user.

RESOLUTION: This is a known bug: (this link is an internal Hortonworks link and it's published here for reference purposes)

There is no workaround, this is fixed in 2.1.3 version of ambari, per the bug.