Krishna Chaitanya Muttevi created RANGER-5696:
-------------------------------------------------
Summary: Provide configuration in Ranger Usersync to exclusively
use the uSNChanged attribute for Active Directory incremental sync
Key: RANGER-5696
URL: https://issues.apache.org/jira/browse/RANGER-5696
Project: Ranger
Issue Type: Improvement
Components: Ranger, usersync
Affects Versions: 3.0.0
Reporter: Krishna Chaitanya Muttevi
Currently, Ranger Usersync's incremental synchronization mechanism detects
changes in Active Directory (AD) by utilizing a search query that checks both
the {{modifyTimeStamp}} and {{uSNChanged}} attributes. By design, this is
executed as an {{OR}} conditional search filter to capture all recent
modifications.
In large-scale enterprise environments, using an {{OR}} condition on both
{{modifyTimeStamp}} and {{uSNChanged}} forces Active Directory to perform
suboptimal query executions. An enterprise customer's AD administrative team
has reported that this specific query structure significantly degrades AD
performance.
Currently, the sync attributes are hardcoded by design, meaning administrators
cannot configure Usersync to drop the {{modifyTimeStamp}} attribute from the
filter to optimize the search.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
