Support Questions

Find answers, ask questions, and share your expertise
Announcements
Celebrating as our community reaches 100,000 members! Thank you!

Ranger UserSync Issue - LDAP

avatar
Rising Star

Hi,

I have Ranger UserSync enabled with LDAP. Everything was fine until I added a new user in LDAP. After adding, I am unable to find the user in Ranger. I tried restarting user-sync multiple times but no success.

I checked LDAP using search filters and the user exists with correct details. Any suggestions for debugging this issue or has anyone faced something like this in past?

Nothing helpful in ranger/user-sync & ranger/admin logs. Looks like users with groups are added. I see logs from "LdapUserGroupBuilder" class.

1 ACCEPTED SOLUTION

avatar

If you enable Group search first, usersync starts with syncing groups and bringing in users belonging to those groups (of course with your filter settings). Most likely this new user did not have any groups (for your filter), so did not get sync'ed.

View solution in original post

5 REPLIES 5

avatar

Can you try adding groups to this user?

Enable debug and see if there are any logs in usersync or admin logs. If possible, share the configs like ldap search filters and search base.

avatar
Rising Star

@vperiasamy - Check my update. I believe the problem was "Users not belonging to a group". But, I did not understand why only users with groups were pulled. I would love to know the details if someone has an explanation how Ranger UserSync works.

avatar
Rising Star

Update -- I got the new users by disabling "Group Search First" and "Enable User Search".

Although, I would like to know what the difference between them and how exactly Ranger UserSync syncs users and group. Thank you!

avatar

If you enable Group search first, usersync starts with syncing groups and bringing in users belonging to those groups (of course with your filter settings). Most likely this new user did not have any groups (for your filter), so did not get sync'ed.

avatar
Rising Star

@vperiasamy -- Agree, that's what I understood hard way 🙂 I though Ranger will sync groups with users as well as users without groups.

So should I disable group search first and keep user & user-group mapping. Any suggestions?