<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> Ouch! The AD admins have already expressed an unwillingness to move some users into a separate container. And I don’t want to have several thousand unnecessary entries in my IPA system. It looks like
password synchronization is not going to be an option.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> -Mark<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal" style="text-autospace:none"><b><span lang="EN-GB" style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray"><o:p> </o:p></span></b></p>
<p class="MsoNormal" style="text-autospace:none"><b><span lang="EN-GB" style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray">________________________________________________________________<o:p></o:p></span></b></p>
<p class="MsoNormal" style="text-autospace:none"><b><span lang="EN-GB" style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray">Mark Tovey - UNIX Engineer | Service Strategy & Design<o:p></o:p></span></b></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-GB" style="font-size:7.5pt;font-family:"Arial","sans-serif";color:blue"><a href="http://www.go2uti.com/">UTi</a>
</span><span lang="EN-GB" style="font-size:7.5pt;font-family:"Arial","sans-serif";color:gray">| 400 SW Sixth Ave, Suite 1100 | Portland | Oregon | 97204 | USA<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-GB" style="font-size:7.5pt;font-family:"Arial","sans-serif";color:gray"><a href="mailto:MTovey@go2uti.com">MTovey@go2uti.com</a> | O / C +1 503 953-1389 | Skype: mark.tovey2</span><span lang="EN" style="color:#1F497D"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext"> Rich Megginson [mailto:rmeggins@redhat.com]
<br>
<b>Sent:</b> Tuesday, July 16, 2013 1:00 PM<br>
<b>To:</b> Tovey, Mark<br>
<b>Cc:</b> Freeipa-users@redhat.com<br>
<b>Subject:</b> Re: [Freeipa-users] Limit password synchronization from Active Directory<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On 07/16/2013 01:48 PM, Tovey, Mark wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> Is there a way to limit what user accounts are synchronized from Active Directory? There are around 15,000 entries in our production AD system, but probably only about 300 of those need to have an account in the IPA system. Can we
set an attribute in the user information in AD that would flag that this is a candidate for replication, and lack of that attribute would cause an account to be skipped?<o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><br>
No. The only thing you can do is create a special container (cn=IPA users or ou=IPA users or something like that), move the users you want to sync into that container, and sync only that container.<br>
<br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal"> Thanks,<o:p></o:p></p>
<p class="MsoNormal"> -Mark<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><b><span lang="EN-GB" style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray"> </span></b><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><b><span lang="EN-GB" style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray">________________________________________________________________</span></b><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><b><span lang="EN-GB" style="font-size:8.0pt;font-family:"Arial","sans-serif";color:gray">Mark Tovey - UNIX Engineer | Service Strategy & Design</span></b><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-GB" style="font-size:7.5pt;font-family:"Arial","sans-serif";color:blue"><a href="http://www.go2uti.com/">UTi</a>
</span><span lang="EN-GB" style="font-size:7.5pt;font-family:"Arial","sans-serif";color:gray">| 400 SW Sixth Ave, Suite 1100 | Portland | Oregon | 97204 | USA</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-GB" style="font-size:7.5pt;font-family:"Arial","sans-serif";color:gray"><a href="mailto:MTovey@go2uti.com">MTovey@go2uti.com</a> | O / C +1 503 953-1389 | Skype: mark.tovey2</span><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><br>
<br>
<br>
<o:p></o:p></span></p>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>Freeipa-users mailing list<o:p></o:p></pre>
<pre><a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><o:p></o:p></pre>
<pre><a href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a><o:p></o:p></pre>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman","serif""><o:p> </o:p></span></p>
</div>
</body>
</html>