Ranger UserSync Issue - LDAP

[#1]

Hi,

I have Ranger UserSync enabled with LDAP. Everything was fine until I added a new user in LDAP. After adding, I am unable to find the user in Ranger. I tried restarting user-sync multiple times but no success.

I checked LDAP using search filters and the user exists with correct details. Any suggestions for debugging this issue or has anyone faced something like this in past?

Nothing helpful in ranger/user-sync & ranger/admin logs. Looks like users with groups are added. I see logs from "LdapUserGroupBuilder" class.

[#2]

Can you try adding groups to this user?

Enable debug and see if there are any logs in usersync or admin logs. If possible, share the configs like ldap search filters and search base.

[#3]

@vperiasamy - Check my update. I believe the problem was "Users not belonging to a group". But, I did not understand why only users with groups were pulled. I would love to know the details if someone has an explanation how Ranger UserSync works.

[#4]

Update -- I got the new users by disabling "Group Search First" and "Enable User Search".

Although, I would like to know what the difference between them and how exactly Ranger UserSync syncs users and group. Thank you!

[#5 · Accepted solution]

If you enable Group search first, usersync starts with syncing groups and bringing in users belonging to those groups (of course with your filter settings). Most likely this new user did not have any groups (for your filter), so did not get sync'ed.

[#6]

@vperiasamy -- Agree, that's what I understood hard way 🙂 I though Ranger will sync groups with users as well as users without groups.

So should I disable group search first and keep user & user-group mapping. Any suggestions?