<html><head></head><body><div>On Fri, 2016-06-10 at 11:01 +0200, Jakub Hrozek wrote:</div><blockquote type="cite"><pre>On Fri, Jun 10, 2016 at 09:54:19AM +0100, lejeczek wrote:
<blockquote type="cite">
hi everyone
there is a master IPA which in some weird way puts AD users into its ldap
catalog. I say weird cause there is no trust nor other sync established,
there was a trust agreement, one way type, but now 'trust-find' shows
nothing, that trust was removed.
but still when I create a user @AD DS a second later I see it in IPA's ldap,
eg.
dn: <a href="mailto:uid=ccnrtest@ccnr.aaa.private.dom">uid=ccnrtest@ccnr.aaa.private.dom</a>,cn=users,cn=compat,dc=private,dc=c
cnr,dc=aaa,dc=private,dc=dom
how to trace the culprit config responsible for this?
</blockquote>
Check the DN, this is not the IPA tree (cn=account), but the compat tree
(cn=compat) populated by the slapi-nis plugin. The intent is to make the
AD users available to non-SSSD clients that can only use LDAP as an
interface.
</pre></blockquote><div>any chance this plugin gets included without user/admin intention, eg. during migrate-ds ?</div><div>is ipa toolkit or I have to go directly to ldap to de/activate plugin(s) ?</div></body></html>