[
https://issues.apache.org/jira/browse/RANGER-1615?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16079042#comment-16079042
]
Raghavender Rao Guruvannagari commented on RANGER-1615:
-------------------------------------------------------
It looks that this is observed when incremental Sync is enabled. Below is the
log that shows inappropriate group search filter
{code:java}
08 Jul 2017 08:20:01 INFO LdapDeltaUserGroupBuilder [UnixUserSyncThread] -
LdapDeltaUserGroupBuilder initialization completed with -- ldapUrl:
ldap://ad-21115.lab.hortonworks.net:3268, ldapBindDn:
[email protected], ldapBindPassword: ***** ,
ldapAuthenticationMechanism: simple, searchBase: dc=hadoop,dc=apache,dc=org,
userSearchBase: [dc=lab,dc=hortonworks,dc=net], userSearchScope: 2,
userObjectClass: user, userSearchFilter: , extendedUserSearchFilter: null,
userNameAttribute: sAMAccountName, userSearchAttributes: [uSNChanged,
sAMAccountName, modifytimestamp], userGroupNameAttributeSet: null,
pagedResultsEnabled: true, pagedResultsSize: 500, groupSearchEnabled: true,
groupSearchBase: [dc=lab,dc=hortonworks,dc=net], groupSearchScope: 2,
groupObjectClass: group, groupSearchFilter: (|(cn=hr1*)(cn=sales*)),
extendedGroupSearchFilter: (&null(|(member={0})(member={1}))),
extendedAllGroupsSearchFilter: null, groupMemberAttributeName: member,
groupNameAttribute: cn, groupSearchAttributes: [uSNChanged, member, cn,
modifytimestamp], groupUserMapSyncEnabled: true, groupSearchFirstEnabled:
true, userSearchEnabled: true, ldapReferral: ignore
08 Jul 2017 08:20:01 INFO UserGroupSync [UnixUserSyncThread] - Begin: initial
load of user/group from source==>sink
{code}
Where as below log shows the Group search filter which is similar to that one
we have with LdapUserGroupBuilder when Incremental sync is disabled.
{code:java}
08 Jul 2017 08:25:21 INFO LdapUserGroupBuilder [UnixUserSyncThread] -
LdapUserGroupBuilder initialization completed with -- ldapUrl:
ldap://ad-21115.lab.hortonworks.net:3268, ldapBindDn:
[email protected], ldapBindPassword: ***** ,
ldapAuthenticationMechanism: simple, searchBase: dc=hadoop,dc=apache,dc=org,
userSearchBase: [dc=lab,dc=hortonworks,dc=net], userSearchScope: 2,
userObjectClass: user, userSearchFilter: , extendedUserSearchFilter:
(objectclass=user), userNameAttribute: sAMAccountName, userSearchAttributes:
[sAMAccountName, memberof], userGroupNameAttributeSet: [memberof],
pagedResultsEnabled: true, pagedResultsSize: 500, groupSearchEnabled: false,
groupSearchBase: [dc=lab,dc=hortonworks,dc=net], groupSearchScope: 2,
groupObjectClass: group, groupSearchFilter: (|(cn=hr1*)(cn=sales*)),
extendedGroupSearchFilter:
(&(objectclass=group)(|(cn=hr1*)(cn=sales*))(|(member={0})(member={1}))),
extendedAllGroupsSearchFilter: (&(objectclass=group)(|(cn=hr1*)(cn=sales*))),
groupMemberAttributeName: member, groupNameAttribute: cn,
groupSearchAttributes: [member, cn], groupUserMapSyncEnabled: true,
groupSearchFirstEnabled: false, userSearchEnabled: true, ldapReferral: ignore
{code}
> LdapUserGroupBuilder and LdapDeltaUserGroupBuilder build LDAP group filter
> inconsistently
> -----------------------------------------------------------------------------------------
>
> Key: RANGER-1615
> URL: https://issues.apache.org/jira/browse/RANGER-1615
> Project: Ranger
> Issue Type: Bug
> Components: usersync
> Affects Versions: master
> Reporter: Rob Vesse
>
> The {{LdapDeltaUserGroupBuilder}} constructs the LDAP filter in a way that is
> inconsistent with {{LdapUserGroupBuilder}} and generates a potentially
> invalid filter:
> {noformat}
> extendedGroupSearchFilter = "(&" + extendedGroupSearchFilter + "(|(" +
> groupMemberAttributeName + "={0})(" + groupMemberAttributeName + "={1})))";
> {noformat}
> Resulting in the following in the logs:
> {noformat}
> 25 May 2017 04:23:11 INFO LdapDeltaUserGroupBuilder [UnixUserSyncThread] -
> LdapDeltaUserGroupBuilder initialization completed with --
> groupSearchEnabled: true, groupSearchBase: [dc=local], groupSearchScope: 2,
> groupObjectClass: posixGroup,
> groupSearchFilter: , extendedGroupSearchFilter:
> (&null(|(memberUid={0})(memberUid={1}))),
> extendedAllGroupsSearchFilter: null, groupMemberAttributeName: memberUid,
> groupNameAttribute: cn, groupSearchAttributes: [uSNChanged, memberUid, cn,
> modifytimestamp], groupUserMapSyncEnabled: false, groupSearchFirstEnabled:
> false, userSearchEnabled: false, ldapReferral: ignore
> {noformat}
> NB - Various bits of the log line deleted for security purposes
> Note the {{&null}} present in the filter
> If you compare with how {{LdapUserGroupBuilder}} builds the filter it does
> the following first:
> {noformat}
> extendedGroupSearchFilter = "(objectclass=" +
> groupObjectClass + ")";
> if (groupSearchFilter != null &&
> !groupSearchFilter.trim().isEmpty()) {
> String customFilter = groupSearchFilter.trim();
> if (!customFilter.startsWith("(")) {
> customFilter = "(" + customFilter + ")";
> }
> extendedGroupSearchFilter = extendedGroupSearchFilter +
> customFilter;
> }
> extendedAllGroupsSearchFilter = "(&" +
> extendedGroupSearchFilter + ")";
> if (!groupSearchFirstEnabled) {
> extendedGroupSearchFilter = "(&" +
> extendedGroupSearchFilter + "(|(" + groupMemberAttributeName + "={0})(" +
> groupMemberAttributeName + "={1})))";
> }
> {noformat}
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
