Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

Ranger UserSync Issue - LDAP

Solved Go to solution

Ranger UserSync Issue - LDAP

Rising Star

Hi,

I have Ranger UserSync enabled with LDAP. Everything was fine until I added a new user in LDAP. After adding, I am unable to find the user in Ranger. I tried restarting user-sync multiple times but no success.

I checked LDAP using search filters and the user exists with correct details. Any suggestions for debugging this issue or has anyone faced something like this in past?

Nothing helpful in ranger/user-sync & ranger/admin logs. Looks like users with groups are added. I see logs from "LdapUserGroupBuilder" class.

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted

Re: Ranger UserSync Issue - LDAP

If you enable Group search first, usersync starts with syncing groups and bringing in users belonging to those groups (of course with your filter settings). Most likely this new user did not have any groups (for your filter), so did not get sync'ed.

View solution in original post

5 REPLIES 5
Highlighted

Re: Ranger UserSync Issue - LDAP

Can you try adding groups to this user?

Enable debug and see if there are any logs in usersync or admin logs. If possible, share the configs like ldap search filters and search base.

Highlighted

Re: Ranger UserSync Issue - LDAP

Rising Star

@vperiasamy - Check my update. I believe the problem was "Users not belonging to a group". But, I did not understand why only users with groups were pulled. I would love to know the details if someone has an explanation how Ranger UserSync works.

Highlighted

Re: Ranger UserSync Issue - LDAP

Rising Star

Update -- I got the new users by disabling "Group Search First" and "Enable User Search".

Although, I would like to know what the difference between them and how exactly Ranger UserSync syncs users and group. Thank you!

Highlighted

Re: Ranger UserSync Issue - LDAP

If you enable Group search first, usersync starts with syncing groups and bringing in users belonging to those groups (of course with your filter settings). Most likely this new user did not have any groups (for your filter), so did not get sync'ed.

View solution in original post

Highlighted

Re: Ranger UserSync Issue - LDAP

Rising Star

@vperiasamy -- Agree, that's what I understood hard way :) I though Ranger will sync groups with users as well as users without groups.

So should I disable group search first and keep user & user-group mapping. Any suggestions?

Don't have an account?
Coming from Hortonworks? Activate your account here