LDAPLinkConfigFile database parameter

Hi,

Has anyone tried to test the LDAPLinkConfigFile database parameter? It is used to read entries from a file instead of actually contacting an LDAP server.

In my testsing, Vertica can read the file as expected, but it does not find a user.

Example:

Here is my LDIF file:

dbadmin=> \! cat /home/dbadmin/ldap.ldif
dn: dc=example,dc=com
dc: example
objectClass: dcObject
objectClass: organization

dn: ou=vertica,dc=example,dc=com
objectClass: organizationalunit
objectClass: top
ou: vertica

dn: ou=dev,vertica,dc=example,dc=com
objectClass: organizationalunit
objectClass: top
ou: dev

dn: cn=knicely,ou=dev,ou=vertica,dc=example,dc=com
objectClass: inetOrgPerson
uid: knicelyuid
cn: knicely

dn: cn=devrole,ou=dev,ou=vertica,dc=example,dc=com
objectClass: groupOfNames
member: cn=knicely,ou=dev,ou=vertica,dc=example,dc=com
cn: devrole

Here are the database LDAP params:

dbadmin=> select parameter_name, current_value from configuration_parameters where parameter_name ilike 'LDAP%';
     parameter_name      |        current_value
-------------------------+-----------------------------
 LDAPLinkFilterUser      | (objectClass=inetOrgPerson)
 LDAPLinkSearchTimeout   | 10
 LDAPLinkInterval        | 86400
 LDAPLinkRetryInterval   | 10
 LDAPLinkStartTLS        | 0
 LDAPLinkURL             |
 LDAPLinkBindPswd        |
 LDAPLinkTLSCACert       |
 LDAPLinkConfigFile      | /home/dbadmin/ldap.ldif
 LDAPLinkFirstInterval   | 120
 LDAPLinkTLSReqCert      | allow
 LDAPLinkStopIfZeroUsers | 1
 LDAPLinkConflictPolicy  | MERGE
 LDAPLinkFilterGroup     | (objectClass=groupOfNames)
 LDAPLinkOn              | 1
 LDAPLinkBindDN          |
 LDAPLinkGroupMembers    | member
 LDAPLinkRetryNumber     | 10
 LDAPLinkSearchBase      | example,dc=com
 LDAPLinkTLSCADir        |
 LDAPLinkScope           | sub
 LDAPLinkGroupName       | cn
 LDAPLinkUserName        | uid
 LDAPLinkDryRun          | 1
(24 rows)

dbadmin=> select ldap_link_sync_start();
  ldap_link_sync_start
-------------------------
 LDAPLinkService hurried
(1 row)

And here is the output in the vertica.log:

2017-07-12 09:53:59.014 Init Session:7fa54bfff700-a0000000004cb1 [Session] <INFO> [Query] TX:a0000000004cb1(v_sfdc_node0001-306059:0x114a3) select ldap_link_sync_start();
2017-07-12 09:53:59.015 Init Session:7fa54bfff700-a0000000004cb1 [VMPI] <INFO> [transaction bind] - New synced txn catalog version : 108 (Old : 75)
2017-07-12 09:53:59.016 Init Session:7fa54bfff700-a0000000004cb1 [Util] <INFO> Task 'LDAPLinkService' enabled
2017-07-12 09:53:59.017 LDAPLinkService:7fa543fff700 [Basics] <INFO> LDAPLink Service: this is clerk. Will run on this node - v_sfdc_node0001.
2017-07-12 09:53:59.017 LDAPLinkService:7fa543fff700 [Basics] <INFO> LDAPLink: Going to read LDAP entries from file '/home/dbadmin/ldap.ldif', no connection needed.
2017-07-12 09:53:59.017 LDAPLinkService:7fa543fff700-a0000000004cb4 [Txn] <INFO> Begin Txn: a0000000004cb4 'LDAP Link service'
2017-07-12 09:53:59.019 LDAPLinkService:7fa543fff700-a0000000004cb4 [Basics] <INFO> Equivalent ldapsearch command (non-TLS format, with paging): ldapsearch -LLL -x -H '' -D '' -w '*****' -b 'example,dc=com' -s 'sub' '(objectClass=groupOfNames)' 'uid' 'cn' 'member'
2017-07-12 09:53:59.019 LDAPLinkService:7fa543fff700-a0000000004cb4 [Basics] <INFO> Equivalent ldapsearch command (non-TLS format, with paging): ldapsearch -LLL -x -H '' -D '' -w '*****' -b 'example,dc=com' -s 'sub' '(objectClass=inetOrgPerson)' 'uid' 'cn' 'member'
2017-07-12 09:53:59.019 LDAPLinkService:7fa543fff700-a0000000004cb4 [Basics] <WARNING> Naming attribute 'cn' not found for entry: 'dc=example,dc=com'
2017-07-12 09:53:59.019 LDAPLinkService:7fa543fff700-a0000000004cb4 [Basics] <WARNING> Naming attribute 'cn' not found for entry: 'ou=vertica,dc=example,dc=com'
2017-07-12 09:53:59.019 LDAPLinkService:7fa543fff700-a0000000004cb4 [Basics] <WARNING> Naming attribute 'cn' not found for entry: 'ou=dev,vertica,dc=example,dc=com'
2017-07-12 09:53:59.019 LDAPLinkService:7fa543fff700-a0000000004cb4 [Basics] <INFO> LDAPLink: Finished reading LDAP entries from file: 1 groups, 0 users read.
2017-07-12 09:53:59.019 LDAPLinkService:7fa543fff700-a0000000004cb4 [Basics] <WARNING> No users were seen in the LDAPLink search results. 'LDAPLinkStopIfZeroUsers' is set to true, so vertica won't drop existing LDAP users, to prevent accidental data loss. If you really want the existing LDAP users to be dropped, please set 'LDAPLinkStopIfZeroUsers' to false and run the sync again.
2017-07-12 09:53:59.019 LDAPLinkService:7fa543fff700-a0000000004cb4 [Txn] <INFO> Rollback Txn: a0000000004cb4 'LDAP Link service'

Notice the entry "LDAPLink: Finished reading LDAP entries from file: 1 groups, 0 users read."

So Vertica found the group but not the user.

Anyone see what I am missing in the LDIF file? Is there some special formatting I am missing?

Thanks!