krishnamuttevi commented on code in PR #1162:
URL: https://github.com/apache/ranger/pull/1162#discussion_r3846291836
##########
ugsync/src/main/java/org/apache/ranger/unixusersync/process/PolicyMgrUserGroupBuilder.java:
##########
@@ -738,6 +740,18 @@ private void computeGroupDelta(Map<String, Map<String,
String>> sourceGroups) {
String curGroupDN =
MapUtils.isEmpty(curGroupAttrs) ? groupName :
curGroupAttrs.get(UgsyncCommonConstants.FULL_NAME);
String newSyncSource =
newGroupAttrs.get(UgsyncCommonConstants.SYNC_SOURCE);
+ // Universal DN Validation Check (Executes first for both
startup & runtime)
+ if (MapUtils.isNotEmpty(curGroupAttrs) &&
!StringUtils.equalsIgnoreCase(groupDN, curGroupDN)) {
Review Comment:
Yes, As per the current version of the code if isDnValidationEnabled =
false, means blocking the domain name change and in this though inter sync
source change was accepted by setting the issyncsourcevalidation enabled =
false, the dn would be changed from Unix to dn of LDAP/Ad which would be
eventually blocked as per the property isDnValidationEnabled.
So to prevent code duplication for both incremental and at startup (restart)
as the check is necessary placed the dn validation block upfront.
If this
Dn = Unix to Dn = {ou=xxx,dc=xx} of LDAP is also considered as dn change and
currently it is blocked.
Should we allow this condition let it change at startup?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
