Uploaded image for project: 'Ambari'
  1. Ambari
  2. AMBARI-19632

Ldap sync fails when there are special characters in distinguished names

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Critical
    • Resolution: Fixed
    • 2.4.0
    • 2.5.0, 2.4.3
    • ambari-server

    Description

      Ldap sync fails when there are special characters in distinguished names.

      For example if there was a user with the distinguished name of OU=test/test,OU=users,DC=EXAMPLE,DC=COM and that user was a member of a synced group, then the lookup of the user using the membership attribute in the group would fail due to the special character.

      The error would look something like

      REASON: Caught exception running LDAP sync. Uncategorized exception occured during LDAP processing; nested exception is javax.naming.NamingException: [LDAP: error code 1 - 000020D6: SvcErr: DSID-031007DB, problem 5012 (DIR_ERROR), data 0
      ]; remaining name 'OU=test/test,OU=users,DC=EXAMPLE,DC=COM'
      

      Solution
      Update the library versionf for Spring LDAP

      • org.springframework.security/spring-security-ldap to 4.0.4.RELEASE
      • org.springframework.ldap/spring-ldap-core to 2.0.4.RELEASE

      Then use LdapUtils.newLdapName to convert a String representing a DN into a javax.naming.ldap.LdapName and use that object in the search facility executed in org.apache.ambari.server.security.ldap.AmbariLdapDataPopulator#getFilteredLdapUsers(java.lang.String, org.springframework.ldap.filter.Filter).

      Attachments

        1. AMBARI-19632_branch-2.5_01.patch
          39 kB
          Robert Levas
        2. AMBARI-19632_trunk_01.patch
          39 kB
          Robert Levas

        Issue Links

          Activity

            People

              rlevas Robert Levas
              rlevas Robert Levas
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: