[AMBARI-13767] LDAP - Group Membership not pulled in with FreeIPA/RHELIDM

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.1.2
• Fix Version/s: 2.2.0
• Component/s: ambari-server

Environment

All OS

• Assignee: Oliver Szabo
• Reporter: Oliver Szabo
• Created: 06/Nov/15 13:50
• Updated: 15/Dec/15 19:13
• Resolved: 01/Dec/15 01:41

Description

When troubleshooting why the group members are not being sync'd with FreeIPA, a packet trace helped identify the issue. With ActiveDirectory the user's DN is exposed as an attribute: "distinguishedName", this is not the case inFreeIPA/RHEL IDM (using 389 DS for the directory server implementation). The DN is not an attribute on the user, and cannot be used in a filter like this:

(&(objectClass=posixaccount)(|(dn=uid=dstreev,cn=users,cn=accounts,dc=hdp,dc=local)(uid=uid=dstreev,cn=users,cn=accounts,dc=hdp,dc=local)))

Issue Links

• is duplicated by: AMBARI-14386 sync-ldap does not pull in group-member associations
• links to: Review board