Here is the .sh script we used at the customers. You'll need to fill in your specific environment information. It runs the curl commands but also includes an LDAP filter.
#!/bin/sh
# Just in case we are run from cron with no path set...
export PATH=/bin:/usr/bin:/usr/sbin:/sbin:/usr/local/bin
AMBARI_ADMIN_USER='admin:xxxxx'
#
# Groups we want to look for, in this case any group name that starts with HDP_
#
GROUP_FILTER="(&(ObjectClass=Group)(CN=HDP_*))"
SEARCH_BASE=DC=MYDOMAIN,DC=com
SEARCH_USER=CN=search_user,OU=LDAP,${SEARCH_BASE}
SEARCH_PASSWD=ldapUserPassword
LDAP_HOST=ldap.mydomain.com
LDAPGROUPS=`ldapsearch -h $LDAP_HOST -x -s sub -b ${SEARCH_BASE} -D ${SEARCH_USER} -w ${SEARCH_PASSWD} "${GROUP_FILTER}" cn | grep ^dn: | cut -d' ' -f2- | sed -e "s/\(.*\)/(memberOf=\1)/" | tr '\n' ':' | sed -e "s/://g"`
# Filter for users with a "valid" flag set who have a first name, last name and email.
SEARCH_FILTER="(&(objectClass=USER)(mail=*mydomain.com)(givenName=*)(sn=*)(!(msexchuserAccountControl:1.2.840.113556.1.4.803:=2))(|$LDAPGROUPS))"
# perform the search on AD and format the results in a way that postfix wants.
#ldapsearch -h <ldap.company.com> -x -D “${SEARCH_USER}” -w “${SEARCH_PASSWD}” "${SEARCH_FILTER}" sAMAccountName | \ grep -v "{" | \ cut -d: -f3 | \ sort -u > ${TEMP_FILE}
USERLIST=`ldapsearch -h $LDAP_HOST -x -s sub -b ${SEARCH_BASE} -D ${SEARCH_USER} -w ${SEARCH_PASSWD} "${SEARCH_FILTER}" sAMAccountName |\
grep -i sAMAccountName |\
grep -v ^# |\
sort -u |\
awk '{print $2}' |\
tr '\n' , |\
tr '[A-Z]' '[a-z]' |\
sed -e "s/,$//"`
GROUPLIST=`ldapsearch -h $LDAP_HOST -x -s sub -b ${SEARCH_BASE} -D ${SEARCH_USER} -w ${SEARCH_PASSWD} "${SEARCH_FILTER}" memberOf |\
grep memberOf |\
grep -v ^# |\
grep HDP_ |\
sort -u |\
cut -d: -f2 |\
cut -d= -f2 |\
cut -d, -f1 |\
awk '{print $1}' |\
tr '\n' , |\
sed -e "s/,$//"`
# Sync new users and groups
curl -s -H "X-Requested-By: ambari” -u $AMBARI_ADMIN_USER -d '{"Event": {"specs": [{"principal_type": "users", "sync_type": "specific", "names": "'$USERLIST'"}, {"principal_type": "groups", "sync_type": "specific", "names": "'$GROUPLIST'"}]}}' http://127.0.0.1:8080/api/v1/ldap_sync_events >/dev/null
sleep 30
# Sync existing users and groups
curl -s -H "X-Requested-By: amber” -u $AMBARI_ADMIN_USER -d '{"Event": { "specs": [{"principal_type": "users", "sync_type": "existing"}, {"principal_type": "groups", "sync_type": "existing"}]}}' http://127.0.0.1:8080/api/v1/ldap_sync_events >/dev/null
echo "AmbariLdapSync complete at `date`"
exit 0
