<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> On 02/12/2012 03:49 PM, Marco Pizzoli wrote: <blockquote cite="mid:CAMrrtwsxWcp6Hc0d+ecqfXcMyfnbuaMknrVNns43nQ5GcLpUBg@mail.gmail.com" type="cite">Hi guys, a couple of questions about AD synchronization. I read in the guide these points: - A synchronization operation runs every five minutes. --> I read that it can be triggered on demand, but is it possibile to change the value of this frequency? </blockquote> I think it is configurable. You might want to check port389 wiki for more details. <blockquote cite="mid:CAMrrtwsxWcp6Hc0d+ecqfXcMyfnbuaMknrVNns43nQ5GcLpUBg@mail.gmail.com" type="cite">- Synchronization can only be configured with one Active Directory domain. Multiple domains are not supported. --> Do they will in a future version? </blockquote> No plans as we are working on trusts and trusts would make synchronization not needed. <blockquote cite="mid:CAMrrtwsxWcp6Hc0d+ecqfXcMyfnbuaMknrVNns43nQ5GcLpUBg@mail.gmail.com" type="cite">- While modifications are bi-directional (going both from Active Directory to FreeIPA and from FreeIPA to Active Directory), new accounts are only uni-directional. New accounts created in Active Directory are synchronized over to FreeIPA. However, user accounts created in FreeIPA must also be added in Active Directory before they will be synchronized. ---> What is the origin of this restriction? I mean, why cannot be created a user in AD by FreeIPA? </blockquote> Time and materials mostly - the support cost is origin of this restriction. It is potentially could be done and DS does this but the use case for IPA is different and dominated by AD so it does not make sense to build a solution when in 95 persent the sync would go from AD to IPA as people already have users there. <blockquote cite="mid:CAMrrtwsxWcp6Hc0d+ecqfXcMyfnbuaMknrVNns43nQ5GcLpUBg@mail.gmail.com" type="cite"> And another question, not related to the synchronization: - In the FreeIPA 389-ds I see used the "DUA Config Profile" objectClass. To learn what it is I already read RFC#4876. Now I would like to have a look at a document/draft/etc.. about his using within FreeIPA. Is it available anywhere? If no, could someone give some explanation? </blockquote> There is no use but we contemplated using it some time in future. So far we have noot seen any real damand for this functionality and it is pretty complex feature to build. <blockquote cite="mid:CAMrrtwsxWcp6Hc0d+ecqfXcMyfnbuaMknrVNns43nQ5GcLpUBg@mail.gmail.com" type="cite">Thanks a lot as usual! Marco <pre wrap=""> <fieldset class="mimeAttachmentHeader"></fieldset> _______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> </pre> </body> </html>