There is a service aimed to create users in Ambari pretending that these users are LDAP users (i.e. user_type must be 'LDAP' in the Ambari databse). The service uses Ambari REST API '/api/v1/users/$USER_NAME' call, which creates a user with user_type='Local' by default. Passing the parameter 'Users/user_type":"LDAP"' has no effect (same reflected in the articles where it is for info purposes only). As a workaround I do a direct update of the database after the user is created:
UPDATE ambari.users SET user_type='LDAP' WHERE user_name=$USER_NAME;
Ambari user management view still shows $USER_NAME as 'Local'. The change in db has no effect until the Ambari server is restarted. The reason is Ambari caches info from database (user cache used in org.apache.ambari.server.controller.internal.UserPrivilegeResourceProvider).
I haven't found any solution to refresh the user cache forcely, via some API call or anything else.
So, my question is how to propagate this change without Ambari Server restart? How to invalidate or update the user cache?
All ideas are welcome!!!
Why do you want to add / edit LDAP user by modifying the Amabri DB? Usually when we run the "ambari-server sync-ldap --all" command then it should sync the ambari database users table accordingly and add/remove the users based on the LDAP users data.
The query that you are executing has missing column ... "ldap_user=1" if ldap_user is 0 means it is local.
UPDATE ambari.users SET ldap_user=1, user_type='LDAP' WHERE user_name='$USER_NAME';
Updating the Ambari DB users table will not be very useful if the ldap is not setup properly as the user will not be authenticated properly against LDAP, So the best option is to use "ambari-server sync-ldap"
Thanks for your answer! I missed this parameter, but anyway it is not fixing the problem. "ambari-server sync-ldap"
doesn't help too much because the user management system in the project differs from the standartized LDAP/AD, which leads to either errors during the sync or to 0 users/groups updated. Login to Ambari is done via SSO, but syncronization between Ambari users/groups and the user management system's users/groups is still required (e.g, for granting users some permissions according to their groups). Thus, there is a script responsible for syncing users/groups in Ambari and happily across the cluster: HDFS/fs home dirs, keytabs etc. This is a short context. But one problem still remains:
So, any ideas how to invalidate the cache, reload the user from db without 'ambari-server restart' or how to create a user of LDAP type via API from the scratch?