Hey Chris, Thanks for your answer;
On Tue, May 14, 2013 at 3:12 PM, Chris Hudson <[email protected]> wrote: > > Hello all, > > I have been playing with trying to set up synchronization between windows > AD --> IPA following the instructions at > > https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/index.html > > A few questions arise; > > 1.) The documentation (specifically on > https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/managing-sync-agmt.html), > (under table 9.2) talks about options to the "ipa-replica-manage connect" > command. Among others, --bindpw and --passsync. With --binddn we specify > the "full user DN of the synchronization identity" (and it's password with > --bindpw ... but I fail to understand which users password should be used > for "--passsync"?? Is it the same user? > > The "--passsync" password is the password that you *will* use for the > "passsync" user should you install the password synchronization package on > your AD controllers. You are essentially setting this password preemptively. > ok, thanks for clearing that up. > > 2.) The documentation says that the "synchronization identity" (see also > above) must exist in the AD domain and "must have replicator, read, search > and write permissions on the AD subtree. What I am trying to do is create > a one way sync from AD --> IPA and I would really like to avoid using a > user (for synching) that has write permissions (in the AD). All my tries > in setting up synchronization fails unless I add the synch-user to the > group "Administrators". I have tried (and failed) using "account admins" > etc. Any pointers here would be great. Sorry for my ignorance when it > comes to Windows. I am sure I am missing something obvious. > > > Someone else can probably comment on this, but the IPA server will need to > bind to the AD controller and pull the necessary information from the > directory...which makes these rights a necessity. > it's just that the ipa-replica-manage manpage (under "WINSYNC") says: "The following examples use the AD administrator account as the synchronization user. This is not mandatory but the user must have read-access to the subtree." (but then, the redhat docs say also _write_ permissions (in the AD) are required.) ..... To do one-way synching AD ---> IPA, I don't see why write permissions in the AD would be necessary? Or am I missing something? Ideally, I'd like to use a useraccount that has _only_ read permissions in the AD for the synchronization. > > 3.) I follow the instructions under "9.4.5" ( > https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/managing-sync-agmt.html#unidirectional-sync) > to setup Uni-directional sync. (only AD --> IPA), and yet, when I go to > remove an account in IPA it gets removed also in the AD. (This I really > want to avoid, thus the need for a read-only user to do the synchronization > - see question 2). > > I do not recall IPA ever removing users from AD. From what I remember, > only certain attributes were bi-directional and deletes were not performed > on AD. Has this changed? > Oh yeah, the user gets "removed" from the AD in the sense that when I click on the user --> properties it tells me that the user is deleted. (the stanza is still there but as far as the AD is concerned, the user is gone). > > > All in all I think the FreeIPA project is amazing and it really gives us > in the Linux community something we haven't had before. If I can iron out > the problems above I am sure it will become a great tool for me and my > client. > > Any input would be most appreciated. > > Thanks > > //James. > > _______________________________________________ > Freeipa-users mailing list > [email protected] > https://www.redhat.com/mailman/listinfo/freeipa-users > > >
_______________________________________________ Freeipa-users mailing list [email protected] https://www.redhat.com/mailman/listinfo/freeipa-users
