[Freeipa-users] Syncing with AD

[James A]

Hey Chris, Thanks for your answer;


On Tue, May 14, 2013 at 3:12 PM, Chris Hudson <chris at redhat.com> wrote:

>
> Hello all,
>
> I have been playing with trying to set up synchronization between windows
> AD --> IPA  following the instructions at
>
> https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/index.html
>
> A few questions arise;
>
> 1.) The documentation (specifically on
> https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/managing-sync-agmt.html),
> (under table 9.2) talks about options to the "ipa-replica-manage connect"
> command. Among others, --bindpw and --passsync.  With --binddn we specify
> the "full user DN of the synchronization identity" (and it's password with
> --bindpw ... but I fail to understand which users password should be used
> for "--passsync"??  Is it the same user?
>
> The "--passsync" password is the password that you *will* use for the
> "passsync" user should you install the password synchronization package on
> your AD controllers. You are essentially setting this password preemptively.
>

ok, thanks for clearing that up.

>
> 2.) The documentation says that the "synchronization identity" (see also
> above) must exist in the AD domain and "must have replicator, read, search
> and write permissions on the AD subtree.  What I am trying to do is create
> a one way sync from AD --> IPA  and I would really like to avoid using a
> user (for synching) that has write permissions (in the AD).  All my tries
> in setting up synchronization fails unless I add the synch-user to the
> group "Administrators". I have tried (and failed) using "account admins"
> etc.   Any pointers here would be great. Sorry for my ignorance when it
> comes to Windows. I am sure I am missing something obvious.
>
>
> Someone else can probably comment on this, but the IPA server will need to
> bind to the AD controller and pull the necessary information from the
> directory...which makes these rights a necessity.
>

it's just that the ipa-replica-manage manpage (under "WINSYNC") says:

"The  following examples use the AD administrator account as the
synchronization user. This is not mandatory but the user must have
read-access to the subtree."

(but then, the redhat docs say also _write_ permissions (in the AD) are
required.) .....  To do  one-way synching   AD ---> IPA, I don't see why
write permissions in the AD would be necessary?  Or am I missing something?

Ideally, I'd like to use a useraccount that has _only_ read permissions in
the AD for the synchronization.





>
> 3.) I follow the instructions under "9.4.5" (
> https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/managing-sync-agmt.html#unidirectional-sync)
> to setup Uni-directional sync. (only AD --> IPA), and yet, when I go to
> remove an account in IPA it gets removed also in the AD.  (This I really
> want to avoid, thus the need for a read-only user to do the synchronization
> - see question 2).
>
> I do not recall IPA ever removing users from AD. From what I remember,
> only certain attributes were bi-directional and deletes were not performed
> on AD. Has this changed?
>


Oh yeah, the user gets "removed" from the AD in the sense that when I click
on the user --> properties it tells me that the user is deleted. (the
stanza is still there but as far as the AD is concerned, the user is gone).



>
>
> All in all I think the FreeIPA project is amazing and it really gives us
> in the Linux community something we haven't had before.   If I can iron out
> the problems above I am sure it will become a great tool for me and my
> client.
>
> Any input would be most appreciated.
>
> Thanks
>
> //James.
>
> _______________________________________________
> Freeipa-users mailing list
> Freeipa-users at redhat.com
> https://www.redhat.com/mailman/listinfo/freeipa-users
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20130514/2b9e8bc0/attachment.htm>