You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ranger.apache.org by "Raghavender Rao Guruvannagari (JIRA)" <ji...@apache.org> on 2017/07/08 08:28:01 UTC
[jira] [Commented] (RANGER-1615) LdapUserGroupBuilder and
LdapDeltaUserGroupBuilder build LDAP group filter inconsistently
[ https://issues.apache.org/jira/browse/RANGER-1615?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16079042#comment-16079042 ]
Raghavender Rao Guruvannagari commented on RANGER-1615:
-------------------------------------------------------
It looks that this is observed when incremental Sync is enabled. Below is the log that shows inappropriate group search filter
{code:java}
08 Jul 2017 08:20:01 INFO LdapDeltaUserGroupBuilder [UnixUserSyncThread] - LdapDeltaUserGroupBuilder initialization completed with -- ldapUrl: ldap://ad-21115.lab.hortonworks.net:3268, ldapBindDn: hadoopadmin@LAB.HORTONWORKS.NET, ldapBindPassword: ***** , ldapAuthenticationMechanism: simple, searchBase: dc=hadoop,dc=apache,dc=org, userSearchBase: [dc=lab,dc=hortonworks,dc=net], userSearchScope: 2, userObjectClass: user, userSearchFilter: , extendedUserSearchFilter: null, userNameAttribute: sAMAccountName, userSearchAttributes: [uSNChanged, sAMAccountName, modifytimestamp], userGroupNameAttributeSet: null, pagedResultsEnabled: true, pagedResultsSize: 500, groupSearchEnabled: true, groupSearchBase: [dc=lab,dc=hortonworks,dc=net], groupSearchScope: 2, groupObjectClass: group, groupSearchFilter: (|(cn=hr1*)(cn=sales*)), extendedGroupSearchFilter: (&null(|(member={0})(member={1}))), extendedAllGroupsSearchFilter: null, groupMemberAttributeName: member, groupNameAttribute: cn, groupSearchAttributes: [uSNChanged, member, cn, modifytimestamp], groupUserMapSyncEnabled: true, groupSearchFirstEnabled: true, userSearchEnabled: true, ldapReferral: ignore
08 Jul 2017 08:20:01 INFO UserGroupSync [UnixUserSyncThread] - Begin: initial load of user/group from source==>sink
{code}
Where as below log shows the Group search filter which is similar to that one we have with LdapUserGroupBuilder when Incremental sync is disabled.
{code:java}
08 Jul 2017 08:25:21 INFO LdapUserGroupBuilder [UnixUserSyncThread] - LdapUserGroupBuilder initialization completed with -- ldapUrl: ldap://ad-21115.lab.hortonworks.net:3268, ldapBindDn: hadoopadmin@LAB.HORTONWORKS.NET, ldapBindPassword: ***** , ldapAuthenticationMechanism: simple, searchBase: dc=hadoop,dc=apache,dc=org, userSearchBase: [dc=lab,dc=hortonworks,dc=net], userSearchScope: 2, userObjectClass: user, userSearchFilter: , extendedUserSearchFilter: (objectclass=user), userNameAttribute: sAMAccountName, userSearchAttributes: [sAMAccountName, memberof], userGroupNameAttributeSet: [memberof], pagedResultsEnabled: true, pagedResultsSize: 500, groupSearchEnabled: false, groupSearchBase: [dc=lab,dc=hortonworks,dc=net], groupSearchScope: 2, groupObjectClass: group, groupSearchFilter: (|(cn=hr1*)(cn=sales*)), extendedGroupSearchFilter: (&(objectclass=group)(|(cn=hr1*)(cn=sales*))(|(member={0})(member={1}))), extendedAllGroupsSearchFilter: (&(objectclass=group)(|(cn=hr1*)(cn=sales*))), groupMemberAttributeName: member, groupNameAttribute: cn, groupSearchAttributes: [member, cn], groupUserMapSyncEnabled: true, groupSearchFirstEnabled: false, userSearchEnabled: true, ldapReferral: ignore
{code}
> LdapUserGroupBuilder and LdapDeltaUserGroupBuilder build LDAP group filter inconsistently
> -----------------------------------------------------------------------------------------
>
> Key: RANGER-1615
> URL: https://issues.apache.org/jira/browse/RANGER-1615
> Project: Ranger
> Issue Type: Bug
> Components: usersync
> Affects Versions: master
> Reporter: Rob Vesse
>
> The {{LdapDeltaUserGroupBuilder}} constructs the LDAP filter in a way that is inconsistent with {{LdapUserGroupBuilder}} and generates a potentially invalid filter:
> {noformat}
> extendedGroupSearchFilter = "(&" + extendedGroupSearchFilter + "(|(" + groupMemberAttributeName + "={0})(" + groupMemberAttributeName + "={1})))";
> {noformat}
> Resulting in the following in the logs:
> {noformat}
> 25 May 2017 04:23:11 INFO LdapDeltaUserGroupBuilder [UnixUserSyncThread] - LdapDeltaUserGroupBuilder initialization completed with --
> groupSearchEnabled: true, groupSearchBase: [dc=local], groupSearchScope: 2, groupObjectClass: posixGroup,
> groupSearchFilter: , extendedGroupSearchFilter: (&null(|(memberUid={0})(memberUid={1}))),
> extendedAllGroupsSearchFilter: null, groupMemberAttributeName: memberUid,
> groupNameAttribute: cn, groupSearchAttributes: [uSNChanged, memberUid, cn, modifytimestamp], groupUserMapSyncEnabled: false, groupSearchFirstEnabled: false, userSearchEnabled: false, ldapReferral: ignore
> {noformat}
> NB - Various bits of the log line deleted for security purposes
> Note the {{&null}} present in the filter
> If you compare with how {{LdapUserGroupBuilder}} builds the filter it does the following first:
> {noformat}
> extendedGroupSearchFilter = "(objectclass=" + groupObjectClass + ")";
> if (groupSearchFilter != null && !groupSearchFilter.trim().isEmpty()) {
> String customFilter = groupSearchFilter.trim();
> if (!customFilter.startsWith("(")) {
> customFilter = "(" + customFilter + ")";
> }
> extendedGroupSearchFilter = extendedGroupSearchFilter + customFilter;
> }
> extendedAllGroupsSearchFilter = "(&" + extendedGroupSearchFilter + ")";
> if (!groupSearchFirstEnabled) {
> extendedGroupSearchFilter = "(&" + extendedGroupSearchFilter + "(|(" + groupMemberAttributeName + "={0})(" + groupMemberAttributeName + "={1})))";
> }
> {noformat}
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)