Created 05-06-2016 12:01 PM
The steps for Ranger configuration (cn=Manager,dc=hortonworks,dc=com etc.) vs LDAP structure (cn=ldapusers,ou=Groups,dc=example,dc=com etc) are not in sync at https://community.hortonworks.com/articles/16696/ranger-ldap-integration.html
Since I don't have much experience on LDAP, is their any reliable step-by-step I can use to quickly get upto speed with Ranger/LDAP integration?
Created 05-06-2016 12:06 PM
@Amit Tewari - http://crazyadmins.com/how-to-integrate-ranger-with-ldap/
If you have any issues, you can ask here.
@Sagar Shimpi and I Can help you.
Created 05-06-2016 12:06 PM
@Amit Tewari - http://crazyadmins.com/how-to-integrate-ranger-with-ldap/
If you have any issues, you can ask here.
@Sagar Shimpi and I Can help you.
Created 05-09-2016 09:00 AM
Thanks @Kuldeep Kulkarni , @Sagar Shimpi
LDAP users synched, however:
Created 05-09-2016 10:46 AM
1. Can you make sure the username and password are correct. Try login from cli just to make ensure.
2. Can you attached ranger usersync.log and xa-portal.log.
Created 05-10-2016 04:00 AM
PS- So far have HDP sandbox setup (with openldap). Not using openldap for domain login.
[root@sandbox ~]# tail -f /usr/hdp/current/ranger-usersync/logs/usersync.log
09 May 2016 09:53:04 INFO LdapUserGroupBuilder [UnixUserSyncThread] - LDAPUserGroupBuilder.updateSink() completed with user count: 2 09 May 2016 09:53:04 INFO UserGroupSync [UnixUserSyncThread] - End: update user/group from source==>sink 09 May 2016 10:53:04 INFO UserGroupSync [UnixUserSyncThread] - Begin: update user/group from source==>sink 09 May 2016 10:53:04 INFO LdapUserGroupBuilder [UnixUserSyncThread] - LDAPUserGroupBuilder updateSink started 09 May 2016 10:53:04 INFO LdapUserGroupBuilder [UnixUserSyncThread] - LdapUserGroupBuilder initialization started 09 May 2016 10:53:04 INFO LdapUserGroupBuilder [UnixUserSyncThread] - LdapUserGroupBuilder initialization completed with -- ldapUrl: ldap://localhost:389, ldapBindDn: cn=Manager,dc=my-domain,dc=com, ldapBindPassword: ***** , ldapAuthenticationMechanism: simple, searchBase: dc=my-domain,dc=com, userSearchBase: ou=users,dc=my-domain,dc=com, userSearchScope: 2, userObjectClass: person, userSearchFilter: , extendedUserSearchFilter: (objectclass=person), userNameAttribute: uid, userSearchAttributes: [uid, ismemberof, memberof], userGroupNameAttributeSet: [ismemberof, memberof], pagedResultsEnabled: true, pagedResultsSize: 500, groupSearchEnabled: false, groupSearchBase: dc=my-domain,dc=com, groupSearchScope: 2, groupObjectClass: groupofnames, groupSearchFilter: *, extendedGroupSearchFilter: (&(objectclass=groupofnames)(*)(member={0})), extendedAllGroupsSearchFilter: (&(objectclass=groupofnames)(*)), groupMemberAttributeName: member, groupNameAttribute: cn, groupUserMapSyncEnabled: false, ldapReferral: ignore 09 May 2016 10:53:04 INFO LdapUserGroupBuilder [UnixUserSyncThread] - Updating user count: 1, userName: atewari, groupList: [] 09 May 2016 10:53:04 INFO LdapUserGroupBuilder [UnixUserSyncThread] - Updating user count: 2, userName: sbansal, groupList: [] 09 May 2016 10:53:04 INFO LdapUserGroupBuilder [UnixUserSyncThread] - LDAPUserGroupBuilder.updateSink() completed with user count: 2 09 May 2016 10:53:04 INFO UserGroupSync [UnixUserSyncThread] - End: update user/group from source==>sink
Created 05-06-2016 12:38 PM
@Amit Tewari If you want to have quick setup pls do also refer - https://community.hortonworks.com/articles/30653/openldap-setup.html
Let us know if you have any problems with ranger ldap integration.
Created 05-10-2016 08:02 AM
From the usersync log it seems that ranger is able to sync with your ldap, below are the logs -
"LdapUserGroupBuilder [UnixUserSyncThread] - Updating user count: 1, userName: atewari,"
"LDAPUserGroupBuilder.updateSink() completed with user count: 2"
Are you able to see "atewari" use in Ranger UI?
Enable debug in ranger - "vi /usr/hdp/current/ranger-admin/ews/webapp/WEB-INF/log4j.xml"
replace info with debug in above file and restart ranger.
Check xa-portal.log and see if you are able to see any error.
Created 05-10-2016 11:16 AM
Yes able to see "atewari" use in Ranger UI. Thanks.