On 02/13/2013 08:10 AM, Rob Crittenden wrote:
Dag Wieers wrote:
Hi,

We are investigating whether IPA is an acceptable solution for our
environment. One of the aspects that is not clear (from reading the
documentation and testing it without AD) is whether the synchronization
with AD can be limited to a subset.


Since we would like to only synchronize certain user-accounts
(conforming to a specific format) from AD unidirectionally, and we also
want to manage functional/technical accounts on IPA, we need to make
sure that we:

  - can filter the stuff we pull from AD

You can set the subtree to use, I'm not sure if you can supply a filter to the winsync agreement. Rich?

No, this is an RFE

This trac report gives a pretty good idea of the limitations of 389 winsync:
https://fedorahosted.org/389/query?component=Sync+Service&status=accepted&status=assigned&status=new&status=reopened&col=id&col=summary&col=status&col=type&col=priority&col=milestone&col=component&order=priority&report=16

see especially
https://fedorahosted.org/389/ticket/178
https://fedorahosted.org/389/ticket/460


- can avoid the synchronisation to remove other accounts managed in IPA

I don't understand the question. You don't want the winsync agreement to affect IPA-specific users? That works.


Can someone confirm that this is possible ? Is there any indepth
information on how this AD sycnhronization works (preferably about RHEL6
IPA) ?

Not beyond what is in the 389-ds-base and IPA documentation. There might be some additional information on the 389-ds wiki.

What would you like to know?



Also since we also require compatibility with Solaris, and roles (RBAC)
is currently used on Solaris, does IPA support RBAC on Solaris ? (We
noticed that RBAC mentioned in the IPA web interface only relates to IPA
management).

No, IPA doesn't support RBAC on Solaris.

rob


_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Reply via email to