[RANGER-4755] [RangeruserSync] Removes users/groups in case of punctual issue to retrieve users/groups

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.2.0
• Component/s: Ranger
• Assignee: Unassigned
• Reporter: Pierrick FLORECK
• Created: 20/Mar/24 17:25
• Updated: 20/Mar/24 17:25

Description

Hi team,

We have encounter an issue on Ranger usersync with ldap synchronization.
(We use a vip for ldap search and the SSL certificate of one node has been changed without updating it in the ranger truststore.)
The user search to retrieve users from Ldap failed (SSLHandshakeException) but the sync cycle continue assuming there are no retrieved users instead of failing for this cycle.
As we were on the delete cycle, account are considered deleted in Ranger and we have Access Denied for all Ranger requests.

We corrected our incident by updating our certificates but usersync's behavior remains dangerous.

Could it be possible to update LdapUserGroupBuilder.java to fail the current sync cycle if the user or group ldap search fail?

Thanks for your help,

Best Regards