RANGER-5110: Prevent entity soft deletion when LDAP DN is updated - #1162
Open
krishnamuttevi wants to merge 2 commits into
Open
RANGER-5110: Prevent entity soft deletion when LDAP DN is updated#1162krishnamuttevi wants to merge 2 commits into
krishnamuttevi wants to merge 2 commits into
Conversation
spolavarpau1
requested changes
Aug 18, 2026
|
|
||
| if (StringUtils.equalsIgnoreCase(curUserAttrsStr, newUserAttrsStr)) { | ||
| userNameMap.put(userDN, userName); | ||
| boolean isLdapAdSync = StringUtils.equalsIgnoreCase(newSyncSource, "LDAP/AD") |
Contributor
There was a problem hiding this comment.
Same comments as above apply here as well
Contributor
Author
There was a problem hiding this comment.
Have updated in the following commit.
Contributor
Author
There was a problem hiding this comment.
Please check the below the below doc for the testcaes which was verified by runtime
…h proper syncing of U&G
…essed reviewer comments
krishnamuttevi
force-pushed
the
RANGER-5110
branch
from
August 20, 2026 14:58
b117e75 to
47a7c81
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes an issue in LDAP/AD sync where users or groups are incorrectly skipped or marked for deletion when their DN changes (e.g., due to OU moves). This PR correctly detects, maps, and updates DN changes efficiently using the existing cache.
Key Changes:
Allow DN Updates: Added an isLdapAdSync check in delta computation (computeUserDelta/computeGroupDelta). If a DN changes, the update is now explicitly allowed rather than skipped, and old DN mappings are cleaned up.
Smart Deletion Check:
Before marking an entity as deleted due to a missing DN (computeDeletedUsers/computeDeletedGroups), we now verify if the base name still exists in the source. If it does, deletion is bypassed so the delta sync can naturally correct the DN.
Why this approach (vs. PR #516)
Better Performance: Avoids the heavy REST reloads and cache wiping introduced in #516. We utilize the existing cache.
Complete Fix: Actually updates the entity with the new DN across cycles (PR #516 only attempts a soft-delete and fails to map the new DN).
Cleaner: Highly efficient fix with a significantly smaller LOC footprint.
Testing:
Verified LDAP/AD users and groups update correctly during OU moves.
Confirmed no extra cache-clearing loads are triggered.
Verified non-LDAP/AD sync behavior remains unaffected.