Created 04-30-2021 11:52 AM
I am facing an issue while running ranger user sync. It's able to sync groups but not users. I am not getting any errors also.
Created 04-30-2021 12:29 PM
Not sure if this older solution will help but it's worth a look.
Created 05-24-2021 03:32 AM
Did you enable user search and Please share usersync configs.
Created 05-25-2021 01:45 AM
Hi, Are you able to see the users in the usersync logs ? can you please share the usersync logs from ranger and also some users which are not synced to check logs.
Created 05-26-2021 04:57 AM
Below are configuration for connecting Apache Ranger with LDAP/LDAPS. There's an important tool that will help to identify some settings in your AD AD Explorer - Windows Sysinternals | Microsoft Docs
This configuration will sync LDAP users and link them with their LDAP groups every 12 hour, so you later from Apache Ranger you can give permission based on LDAP groups as well.
For connecting using LDAPS, make sure you have the proper certificates added in the same server that contains the Ranger's UserSync service.
|Configuration Name||Configuration Value||Comment|
|ranger.usersync.ldap.url||ldaps://myldapserver.example.com||ldaps or ldap based on your LDAP security|
|ranger.usersync.ldap.searchBase||OU=hadoop,DC=example,DC=com||you can browse your AD and check which OU you want to make Ranger sync|
|ranger.usersync.ldap.user.searchbase||OU=hadoop2,DC=example,DC=com;OU=hadoop,DC=example,DC=com||you can browse your AD and check which OU you want to make Ranger sync, you can also add 2 OU and separate them with ;|
|ranger.usersync.ldap.user.objectclass||user||double check the same|
|ranger.usersync.ldap.user.searchfilter||(memberOf=CN=HADOOP_ACCESS,DC=example,DC=com)||if you want to filter specific users to be synced in ranger and not your entire AD|
|ranger.usersync.ldap.user.nameattribute||sAMAccountName||double check the same|
|ranger.usersync.ldap.user.groupnameattribute||memberOf||double check the same|
|ranger.usersync.group.searchbase||OU=hadoop,DC=example,DC=com||you can browse your AD and check which OU you want to make Ranger sync|
|ranger.usersync.group.objectclass||group||double check the same|
|ranger.usersync.group.searchfilter||(cn=hadoop_*)||if you want to sync specific groups not all AD groups|
|ranger.usersync.group.nameattribute||cn||double check the same|
|ranger.usersync.group.memberattributename||member||double check the same|
There's some helpful links about how to construct complex LDAP search queries Search Filter Syntax - Win32 apps | Microsoft Docs