Support Questions
Find answers, ask questions, and share your expertise

Ranger: users from ad group not synced with sAMAccountName with user search enabled

Solved Go to solution
Highlighted

Ranger: users from ad group not synced with sAMAccountName with user search enabled

New Contributor

Hello,

I'm currently stuck on trying to configure ranger-usersync properly with our Active Directory.

Platform: HDP 2.6.1.0 on RHEL 7 with Ambari 2.5.1.0

I followed this article:

https://community.hortonworks.com/articles/105620/configuring-ranger-usersync-with-adldap-for-a-comm...

I want to use "Group based search".

The sync works fine when “Enable User Search” is set to “false”.

Problem is that the outcome is the CN of the user, which equals "[first name] [last name] [someID]".

This in turn cannot be mapped by HDFS to Kerberos tickets, which equal [someID]@EXAMPLE.DOMAIN.COM.

Therefore I want to enable "User Search" with this configuration:

ranger.usersync.ldap.user.nameattribute = sAMAccountName 
ranger.usersync.ldap.user.objectclass = person 
ranger.usersync.ldap.searchbase = DC=EXAMPLE,DC=DOMAIN,DC=COM
ranger.usersync.ldap.searchfilter = sAMAccountName=*
ranger.usersync.ldap.searchscope = sub
ranger.usersync.ldap.user.groupnameattribute = memberof,ismemberof
ranger.usersync.group.usermapsyncenabled = true
ranger.usersync.user.searchenabled = true

Configuration for groups is the same as mentioned in the article.

--> Goal is to fetch the groups using Attribute cn and fetch all members of those groups as received per the attribute "member". And to create the users from this, bu create them using the attribute "sAMAccountName" of the user.

Hope somebody can help me, thanks!

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Ranger: users from ad group not synced with sAMAccountName with user search enabled

Expert Contributor
@Th Kr

This issue has been fixed recently (https://issues.apache.org/jira/browse/RANGER-1632).

View solution in original post

3 REPLIES 3
Highlighted

Re: Ranger: users from ad group not synced with sAMAccountName with user search enabled

New Contributor

Seem like I found the basic problem:

when I disable "incremental sync", the users are created correctly.

Is this desired behaviour or a bug?

Re: Ranger: users from ad group not synced with sAMAccountName with user search enabled

Expert Contributor
@Th Kr

This issue has been fixed recently (https://issues.apache.org/jira/browse/RANGER-1632).

View solution in original post

Highlighted

Re: Ranger: users from ad group not synced with sAMAccountName with user search enabled

New Contributor

Thanks! didn't see that issue, awesome that it's already fixed in 0.7.2