krishnamuttevi opened a new pull request, #1218: URL: https://github.com/apache/ranger/pull/1218
### Summary: Add configuration property to optimize AD/LDAP delta sync search filters **Description:** Currently, Ranger Usersync uses an OR conditional query containing both modifyTimeStamp and uSNChanged attributes to detect changes during delta syncs. According to customer feedback, executing a search query with both attributes combined negatively affects Active Directory (AD) performance. At present, this behavior is hardcoded by design and cannot be configured to use only the environment-specific attribute (such as uSNChanged for AD). **Changes:** Introduced a new configuration property (e.g., ranger.usersync.ldap.deltasync.servertype) to allow administrators to specify the directory server type and optimize the search query: **When set to ad:** _The delta sync query uses only the uSNChanged attribute._ **When set to ldap:** _The delta sync query uses only the modifyTimestamp attribute._ **When empty or unset:** _Falls back to the existing OR-combined filter to ensure backward compatibility._ **Impact:** Improves Active Directory search performance and reduces query overhead by eliminating complex OR conditions and avoiding unsupported attribute queries. There is no behavioral change or impact on existing deployments unless the new property is explicitly configured. **Testing:** - _Verified delta sync works correctly against Active Directory when the property is configured as ad._ - _Verified delta sync works correctly against OpenLDAP when the property is configured as ldap._ - _Verified legacy backward compatibility behaves as expected (using the OR conditional) when the property is not configured._ - _Tested the performance by synchronizing ~1.14 million users. With the optimized ad configuration, the sync process completed 1 minute faster compared to the default OR-combined filter._ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
