[RANGER-4026] Provide option to update group memberships when same users/groups are synced from different sync sources

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.4.0
• Fix Version/s: 3.0.0, 2.5.0
• Component/s: usersync
• Assignee: Abhishek Kumar
• Reporter: Sailaja Polavarapu
• Created: 22/Dec/22 00:42
• Updated: 21/Jun/24 00:23
• Resolved: 07/Jun/23 04:21

Description

RANGER-3254 implemented a change in user/group mapping so that sync source is taken into account when a group name matches multiple sources. LDAP users belonging to a group like "CN=mygroup" will not be synced in Ranger if there is an existing "mygroup" that was imported by UnixUserGroupBuilder.

This breaks a very common use case where posix users and groups are synced to the OS from an LDAP backend using SSSD, Centrify, or similar utilities. In those cases, both the linux OS and LDAP/AD are using the same identity repository. If Ranger imported a set of users and groups from one sync source, and then later switches to another, group mappings break and users don't get all of their groups.

Provide an option for customers to treat users/groups from multiple sync sources as same for updating group memberships.