krishnamuttevi commented on code in PR #1162:
URL: https://github.com/apache/ranger/pull/1162#discussion_r3846291836
##########
ugsync/src/main/java/org/apache/ranger/unixusersync/process/PolicyMgrUserGroupBuilder.java:
##########
@@ -738,6 +740,18 @@ private void computeGroupDelta(Map<String, Map<String,
String>> sourceGroups) {
String curGroupDN =
MapUtils.isEmpty(curGroupAttrs) ? groupName :
curGroupAttrs.get(UgsyncCommonConstants.FULL_NAME);
String newSyncSource =
newGroupAttrs.get(UgsyncCommonConstants.SYNC_SOURCE);
+ // Universal DN Validation Check (Executes first for both
startup & runtime)
+ if (MapUtils.isNotEmpty(curGroupAttrs) &&
!StringUtils.equalsIgnoreCase(groupDN, curGroupDN)) {
Review Comment:
Yes, Since the inclusion of the isDnValidationEnabled = false, means
blocking the domain name change and in this though inter sync source change was
accepted by setting the issyncsourcevalidation enabled = false, the dn would be
changed from Unix to dn of LDAP/Ad which would be eventually blocked as per the
property isDnValidationEnabled.
So to prevent code duplication for both incremental and at startup (restart)
as the check is necessary placed the dn validation block upfront
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
