[Fedora-directory-users] Re: [Fedora Directory Users] Winsync woes
David Boreham
david_list at boreham.org
Wed Aug 3 13:46:59 UTC 2005
>If I may be so bold as to take advantage of your knowledge and kindness - when
>I created the Windows Sync Agreement, I specified the DS subtree as
>ou=People,dc=headquarters,dc=mydomain,dc=com, and the Windows subtree as
>cn=People,dc=headquarters,dc=mydomain,dc=com. When the sync completed, all
>Windows users and groups ended up in the FDS People subtree. How would I get
>Windows groups to populate the FDS gorups subtree, and only users to populate
>the People subtree?
>
>
In this current release it's not possible to do exactly what you want
(at least I can't think of an easy way to to it). The problem is that there
are two conventions for storing users vs. groups in the DIT: a) put
users and groups in the same container and b) put users in one
container and groups in a sibling container. You can deploy either
convention in both AD and FDS, but in order to have an easy life
in terms of Winsync, you need to use the _same_ convention on
both sides. Note that the fact that FDS has ou=People and ou=Groups
is simply a convention in the sample data loaded on request at install time.
You can easily adopt the same convention as is commonly used with AD:
put users and groups in the same container. (AD didn't exist when
we invented the ou=People, ou=Groups convention at Netscape way back).
You _could_ defined two sync agreements : one to sync users and
the other to sync groups. Problem is that you would be pointing both
at the same subtree on the AD side and I believe that bad stuff would
happen as a result (there's no way to tell an agreement to only sync
groups, for example).
More information about the Fedora-directory-users
mailing list