<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 11/12/2013 01:29 AM, gflwqs gflwqs
wrote:<br>
</div>
<blockquote
cite="mid:CAFYgF=ob2ZF5n5foANygTK4JH_rEy2gcTs43NoRF-evzsYzSfw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>
<div>
<div>
<div>Hi,<br>
</div>
I have created the sync user with:<br>
- <span class=""><strong>Replicating directory
changes</strong></span> rights to the synchronized
Active Directory subtree.<br>
- A member of the <span class=""><strong>Account
Operator</strong></span> and <span class=""><strong>Enterprise
Read-Only Domain controller</strong></span>
groups.<br>
<br>
<br>
</div>
<div>The user attribute syncronization is working fine,
however the passync from IPA to AD does not work, i
get this error message when i change a password for a
user from IPA: <br>
(00000005: SecErr: DSID-031A121F, problem 4003
(INSUFF_ACCESS_RIGHTS), data 0 ) for modify operation
<br>
<br>
</div>
<div>If i add the sync user to the Domain Admins group
it works, however according to the docs this should
not be necessary?<br>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<a class="moz-txt-link-freetext" href="http://port389.org/wiki/Howto:WindowsSync#Creating_AD_User_with_Replication_Rights">http://port389.org/wiki/Howto:WindowsSync#Creating_AD_User_with_Replication_Rights</a><br>
<blockquote
cite="mid:CAFYgF=ob2ZF5n5foANygTK4JH_rEy2gcTs43NoRF-evzsYzSfw@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>
<div>
<div>
</div>
<div><br>
<br>
</div>
</div>
</div>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Freeipa-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
</body>
</html>