<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_1_1463637291271_3670">We have:</div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr">AD->winsync->FIPA1<->replica<->FIPA2</div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr">etc to multiple other replicas from FIPA1</div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr"><br></div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr"><br></div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr">What we want is to establish separate set of FIPA replicas which wold still have information from AD and yet would not 'pollute' the FIPA1/FIPA2 replicas above.</div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr"><br></div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr">So far we have considered following options:</div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr">1. Set up new FIPA3 replica to grab its information from FIPA1.</div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr">This didn't work as two-way-trust would replicate 'bad' information from FIPA3 back to FIPA1/2</div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr"><br></div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr">2. One way trust between replicas.</div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr">Somehow establish one way replication from FIPA1->FIPA3. 'Good' information gets to FIPA3. But new additions on FIPA3 won't make it back to 'clean' environment.</div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr">From reading posts on the list this is impossible. </div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr"><br></div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr">3. Setup separate winsync 'channels' from AD directly to FIPA3. Ie AD->winsync->FIPA3.</div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr">The problem with this is winsync of user accounts is possible, but password sync requires there to be only one point of contact between AD domain and FIPA domain.</div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr">That is all AD controllers contact one and only one FIPA controller using passsync utility. So there is no way (if I understand correctly) to do:</div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr">AD->sync->FIPA1</div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr"> ->sync->FIPA3</div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr"><br></div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr">If my understanding above is correct what would be the correct way of setting up separate FIPA environments, sourced from the same AD domain and to replicate both users and passwords?</div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr"><br></div><div id="yui_3_16_0_1_1463637291271_3670" dir="ltr">thanks</div></div></body></html>