krishnamuttevi opened a new pull request, #1162: URL: https://github.com/apache/ranger/pull/1162
Fixes an issue in LDAP/AD sync where users or groups are incorrectly skipped or marked for deletion when their DN changes (e.g., due to OU moves). This PR correctly detects, maps, and updates DN changes efficiently using the existing cache. **Key Changes:** Allow DN Updates: Added an isLdapAdSync check in delta computation (computeUserDelta/computeGroupDelta). If a DN changes, the update is now explicitly allowed rather than skipped, and old DN mappings are cleaned up. **Smart Deletion Check:** Before marking an entity as deleted due to a missing DN (computeDeletedUsers/computeDeletedGroups), we now verify if the base name still exists in the source. If it does, deletion is bypassed so the delta sync can naturally correct the DN. **Why this approach (vs. PR #516)** Better Performance: Avoids the heavy REST reloads and cache wiping introduced in #516. We utilize the existing cache. Complete Fix: _Actually updates the entity with the new DN across cycles (PR #516 only attempts a soft-delete and fails to map the new DN)._ Cleaner: _Highly efficient fix with a significantly smaller LOC footprint._ **Testing:** Verified LDAP/AD users and groups update correctly during OU moves. Confirmed no extra cache-clearing loads are triggered. Verified non-LDAP/AD sync behavior remains unaffected. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
