Community Articles
Find and share helpful community-sourced technical articles.
Labels (1)

Problem Statement:

when doing an ambari-server sync-ldap -groups=<your file>

It will bring over the groups but not the users in it.

ROOT CAUSE: When troubleshooting why the group members are not being sync'd with FreeIPA, a packet trace helped identify the issue. With ActiveDirectory the user's DN is exposed as an attribute: "distinguishedName", this is not the case inFreeIPA/RHEL IDM (using 389 DS for the directory server implementation). The DN is not an attribute on the user, and cannot be used in a filter like this:

(&(objectClass=posixaccount)(|(dn=uid=dstreev,cn=users,cn=accounts,dc=hdp,dc=local)(uid=uid=dstreev,cn=users,cn=accounts,dc=hdp,dc=local)))

If we want to retrieve a specific object by DN we have to set the DN as the search base and do a base search scope.

ldapsearch -H ldap://ad.hortonworks.local:389 -x -D "CN=hadoopsvc,CN=Users,dc=hortonworks,dc=local" -W -b "CN=paul,CN=Users,DC=hortonworks,DC=local" -s base -a always "(objectClass=user)"

In this case I'm looking for the user with DN: CN=paul,CN=Users,DC=hortonworks,DC=local. My bind user is hadoopsvc, and because this is AD my objectClass is user.

RESOLUTION: This is a known bug: https://hortonworks.jira.com/browse/BUG-45536 (this link is an internal Hortonworks link and it's published here for reference purposes)

There is no workaround, this is fixed in 2.1.3 version of ambari, per the bug.

439 Views
Take a Tour of the Community
Don't have an account?
Version history
Last update:
‎12-24-2016 06:49 PM
Updated by:
Contributors
Top Kudoed Authors
; ;