I'm trying to sync users and groups from an Active Directory LDAP which is using SSL. I'm using Ambari 2.1.0 I have used the following information on setup-ldap: At the Primary URL* prompt, enter the server URL and port you collected above. Prompts marked with an asterisk are required values.
ldaps://<ADServerName>:636 (note, I have tried this without the ldaps prefix, but got the same error)
At the Secondary URL* prompt, enter the secondary server URL and port. This value is optional.
At the Use SSL* prompt, enter your selection. If using LDAPS, enter true.
true
At the User object class* prompt, enter the object class that is used for users.
inetOrgPerson
At the User name attribute* prompt, enter your selection. The default value is uid.
(default)
At the Group object class* prompt, enter the object class that is used for groups.
group
At the Group name attribute* prompt, enter the attribute for group name.
cn (default)
At the Group member attribute* prompt, enter the attribute for group membership.
member
At the Distinguished name attribute* prompt, enter the attribute that is used for the distinguished name.
dn (default)
At the Base DN* prompt, enter your selection.
<BaseDN>
At the Referral method* prompt, enter to follow or ignore LDAP referrals.
follow
At the Bind anonymously* prompt, enter your selection.
false
At the Manager DN* prompt, enter your selection if you have set bind.Anonymously to false.
<BindDN>
At the Enter the Manager Password* prompt, enter the password for your LDAP manager DN.
<BindDNpw>
Do you want to provide custom TrustStore for Amabari
y
TrustStoretype [jks/jceks/pkcs12] (jks)
jks (default)
Path to TrustStore file:
/etc/ambari-server/keys/ldaps-keystore.jks
Password for TrustStore
Re-enter password:
====================
Review Settings
====================
authentication.ldap.managerDn: <BindDN>
authentication.ldap.managerPassword: <BindDNpw>
ssl.trustStore.type: jks
ssl.trustStore.path: /etc/ambari-server/keys/ldaps-keystore.jks
ssl.trustStore.password:
Save settings [y/n] (y)? y
Saving...done
Ambari Server 'setup-ldap' completed successfully.
I have tried this originally without the TrustStore set up (originally), then I tried again with a self-signed certificate using the instructions in Section 3.3.2.3. Create and Import Self-Signed Certificate in Hadoop Security Guide (May 26, 2015) When I try to do an LDAP Sync, I get this error ambari-server sync-ldap --users users.txt --groups groups.txt
Using python /usr/bin/python2.6
Syncing with LDAP...
Enter Ambari Admin login: admin
Enter Ambari Admin password:
Syncing specified users and groups.ERROR: Exiting with exit code 1.
REASON: Sync event creation failed. Error details: HTTP Error 503: Service Unavailable I have successfully used the same BindDN info, etc using the ldapsearch command on the command line, and using that, I can list the users and groups that I am trying sync. Any suggestions on how I can figure out why I'm getting this error?
... View more
