Support Questions

Find answers, ask questions, and share your expertise

Ranger UserSync Issue - LDAP

Rising Star

Hi,

I have Ranger UserSync enabled with LDAP. Everything was fine until I added a new user in LDAP. After adding, I am unable to find the user in Ranger. I tried restarting user-sync multiple times but no success.

I checked LDAP using search filters and the user exists with correct details. Any suggestions for debugging this issue or has anyone faced something like this in past?

Nothing helpful in ranger/user-sync & ranger/admin logs. Looks like users with groups are added. I see logs from "LdapUserGroupBuilder" class.

1 ACCEPTED SOLUTION

If you enable Group search first, usersync starts with syncing groups and bringing in users belonging to those groups (of course with your filter settings). Most likely this new user did not have any groups (for your filter), so did not get sync'ed.

View solution in original post

5 REPLIES 5

Can you try adding groups to this user?

Enable debug and see if there are any logs in usersync or admin logs. If possible, share the configs like ldap search filters and search base.

Rising Star

@vperiasamy - Check my update. I believe the problem was "Users not belonging to a group". But, I did not understand why only users with groups were pulled. I would love to know the details if someone has an explanation how Ranger UserSync works.

Rising Star

Update -- I got the new users by disabling "Group Search First" and "Enable User Search".

Although, I would like to know what the difference between them and how exactly Ranger UserSync syncs users and group. Thank you!

If you enable Group search first, usersync starts with syncing groups and bringing in users belonging to those groups (of course with your filter settings). Most likely this new user did not have any groups (for your filter), so did not get sync'ed.

Rising Star

@vperiasamy -- Agree, that's what I understood hard way 🙂 I though Ranger will sync groups with users as well as users without groups.

So should I disable group search first and keep user & user-group mapping. Any suggestions?

Take a Tour of the Community
Don't have an account?
Your experience may be limited. Sign in to explore more.