OpenShift LDAP Sync error would search outside of the base dn specified

Issue

• In 3.x:

# oadm groups sync --whitelist=whitelist.txt --sync-config=ldap.yaml --confirm

Error determining LDAP group membership for "cn=ocpusers,ou=Groups,ou=YES,dc=EXAMPLE,dc=COMPANY,dc=net": search for entry with dn="cn=ocpusers,ou=Groups,ou=YES,dc=EXAMPLE,dc=COMPANY,dc=net" would search outside of the base dn specified (dn="ou=no,dc=example,dc=company,dc=net").

• In 4.x:

# oc adm groups sync --sync-config ldap-sync.yaml

membership lookup for user "cn=openshift-auth-group,cn=groups,cn=accounts,dc=prodint,dc=torontomu,dc=ca" in group "cn=sss-openshift,cn=groups,cn=accounts,dc=prodint,dc=torontomu,dc=ca" skipped because of "search for entry with dn="cn=sss-openshift,cn=groups,cn=accounts,dc=prodint,dc=torontomu,dc=ca" would search outside of the base dn specified (dn="cn=users,cn=accounts,dc=prodint,dc=torontomu,dc=ca")"

• OpenShift LDAP Group Sync does not work when the equivalent ldapsearch does