[Freeipa-users] nothing sync'ed to AD

[Will Last]

Many thanks, Bob, for letting me know that I missed the important point as
designed, and for giving me the confidence that my setup is correct after
scratching my head for two weeks:-D.

So, is there any solution for my case, i.e., *using an already setup
freeipa as the primary service, and AD as the secondary (only for those
dependent on AD)*,  in addition to Petr's suggestion to setup freeipa-AD
trust? I prefer to maintain user info in freeipa and let AD sync from
freeipa. But unfortunately, this is not designed to be so. Did anyone try
the idea of export users from freeipa and then import into AD, since they
both use LDAP? At least for the initial pseudo/manual sync. It would be
great to share your experience with us.

Thanks!


On Thu, Apr 17, 2014 at 10:16 PM, Rob Crittenden <rcritten at redhat.com>wrote:

> Will Last wrote:
>
>> Hi,
>>
>> I have got a freeipa server (pa-server-3.0.0-37) running on centos 6.5
>> and am trying to set up sync with/to AD on win 2008/R2, basically
>> following
>> https://access.redhat.com/site/documentation/en-US/Red_
>> Hat_Enterprise_Linux/6/html/Identity_Management_Guide/
>> active-directory.html.
>> The sync agreement is bi-directional by default. But only AD users are
>> sync'ed to freeipa and none of the users on freeipa is sync'ed to ad,
>> which is what I really cared for. Even a re-initialization from AD won't
>> help (ipa-replica-manage re-initialize --from ad.example.com
>> <http://ad.example.com> ). I have turned debugging on
>>
>> (nsslapd-errorlog-level to 8192), but did not see any obvious clue.
>>
>> Thanks in advance for any help!
>>
>
> This is working as designed. IPA-only users are not synced to AD. The
> bidirectional part is that changes to an AD user synced to IPA on the IPA
> side will be synced back to AD.
>
> rob
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20140418/89fa5a74/attachment.htm>