<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 07/16/2013 04:06 PM, Tovey, Mark wrote: </div> <blockquote cite="mid:159018F515D5B14CA76C88F9C425325A65E020@sinmpt10.corp.go2uti.com" type="cite"> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> <div class="WordSection1"> <o:p> </o:p> Ouch! The AD admins have already expressed an unwillingness to move some users into a separate container. And I don’t want to have several thousand unnecessary entries in my IPA system. It looks like password synchronization is not going to be an option. </div> </blockquote> With 389 it is possible to disable sync of AD user creation to DS. <a class="moz-txt-link-freetext" href="https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server/9.0/html/Administration_Guide/Using_Windows_Sync-Synchronizing_Users.html">https://access.redhat.com/site/documentation/en-US/Red_Hat_Directory_Server/9.0/html/Administration_Guide/Using_Windows_Sync-Synchronizing_Users.html</a> 12.4.4.2. Configuring User Sync in the Command Line To disable user sync, set nsds7NewWinUserSyncEnabled: off Then, you will add the ntUser objectclass to each IPA user you want to sync, and at the same time add the attribute ntUserDomainID: username (corresponds to the AD user samAccountName attribute). This will "link" the IPA user entry to the corresponding AD user entry. You mention password sync and user sync - I'm not sure if you mean them separately, or if you are implying that they have to be used together - they do not. You should be able to install PassSync on your domain controllers _without configuring a winsync agreement in IPA_. PassSync should then just ignore password changes for users that it cannot find in IPA. <blockquote cite="mid:159018F515D5B14CA76C88F9C425325A65E020@sinmpt10.corp.go2uti.com" type="cite"> <div class="WordSection1"> <o:p></o:p> Thanks,<o:p></o:p> -Mark<o:p></o:p> <o:p> </o:p> <div> <o:p> </o:p> ________________________________________________________________<o:p></o:p> Mark Tovey - UNIX Engineer | Service Strategy & Design<o:p></o:p> <a moz-do-not-send="true" href="http://www.go2uti.com/">UTi</a> | 400 SW Sixth Ave, Suite 1100 | Portland | Oregon | 97204 | USA<o:p></o:p> <a moz-do-not-send="true" href="mailto:MTovey@go2uti.com">MTovey@go2uti.com</a> | O / C +1 503 953-1389 | Skype: mark.tovey2<o:p></o:p> </div> <o:p> </o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Rich Megginson [<a class="moz-txt-link-freetext" href="mailto:rmeggins@redhat.com">mailto:rmeggins@redhat.com</a>] Sent: Tuesday, July 16, 2013 1:00 PM To: Tovey, Mark Cc: <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> Subject: Re: [Freeipa-users] Limit password synchronization from Active Directory<o:p></o:p> </div> </div> <o:p> </o:p> <div> On 07/16/2013 01:48 PM, Tovey, Mark wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> <o:p></o:p> Is there a way to limit what user accounts are synchronized from Active Directory? There are around 15,000 entries in our production AD system, but probably only about 300 of those need to have an account in the IPA system. Can we set an attribute in the user information in AD that would flag that this is a candidate for replication, and lack of that attribute would cause an account to be skipped?<o:p></o:p> </blockquote> No. The only thing you can do is create a special container (cn=IPA users or ou=IPA users or something like that), move the users you want to sync into that container, and sync only that container. <o:p></o:p> Thanks,<o:p></o:p> -Mark<o:p></o:p> <o:p></o:p> ________________________________________________________________<o:p></o:p> Mark Tovey - UNIX Engineer | Service Strategy & Design<o:p></o:p> <a moz-do-not-send="true" href="http://www.go2uti.com/">UTi</a> | 400 SW Sixth Ave, Suite 1100 | Portland | Oregon | 97204 | USA<o:p></o:p> <a moz-do-not-send="true" href="mailto:MTovey@go2uti.com">MTovey@go2uti.com</a> | O / C +1 503 953-1389 | Skype: mark.tovey2<o:p></o:p> <o:p></o:p> <o:p></o:p> <pre>_______________________________________________<o:p></o:p></pre> <pre>Freeipa-users mailing list<o:p></o:p></pre> <pre><a moz-do-not-send="true" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><o:p></o:p></pre> <pre><a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a><o:p></o:p></pre> <o:p> </o:p> </div> </blockquote> </body> </html>