[Freeipa-users] EXTERNAL: Re: Syncing with AD

James A james at atia.se
Tue May 14 14:26:01 UTC 2013


On Tue, May 14, 2013 at 3:56 PM, Joseph, Matthew (EXP) <
matthew.joseph at lmco.com> wrote:

> Hey James,****
>
> ** **
>
> One more thing, what are the values in the registry for your password sync
> application
>
****
>
> The default option for the User Name Field was wrong. It was set to userid
> (or something similar to that) when it should have been uid. I don’t think
> that’s your problem but who knows what else might be wrong.
>

uuuhh.... registry? I am not sure exaclty what you mean by this?  I need to
change some registry setting on the AD server?



> ****
>
> ** **
>
> Also is your IPA sync user in the same OU as your normal users?****
>
> **
>

Yes ...


> **
>
> Matt****
>
> ** **
>
> *From:* freeipa-users-bounces at redhat.com [mailto:
> freeipa-users-bounces at redhat.com] *On Behalf Of *Joseph, Matthew (EXP)
> *Sent:* Tuesday, May 14, 2013 10:50 AM
>
> *To:* James A
> *Cc:* freeipa-users at redhat.com
> *Subject:* Re: [Freeipa-users] EXTERNAL: Re: Syncing with AD****
>
> ** **
>
> Hey James,****
>
> ** **
>
> Like I said the IPA user has read access at the domain level.****
>
> He is also a member of the domain users group.****
>
> ** **
>
> I don’t know why it’s only working if you have him part of the
> administrator group.****
>
> ** **
>
> What does it say in the passync log on the AD server?****
>
> ** **
>
> I tried to do the uni-directional sync but it never worked for me the way
> it was intended and I just stumbled on giving the user only read access to
> the domain.****
>
> ** **
>
> Matt****
>
> ** **
>
> *From:* James A [mailto:james at atia.se <james at atia.se>]
> *Sent:* Tuesday, May 14, 2013 10:42 AM
> *To:* Joseph, Matthew (EXP)
> *Cc:* Chris Hudson; freeipa-users at redhat.com
> *Subject:* EXTERNAL: Re: Syncing with AD****
>
> ** **
>
> ** **
>
> ** **
>
> On Tue, May 14, 2013 at 3:30 PM, Joseph, Matthew (EXP) <
> matthew.joseph at lmco.com> wrote:****
>
> Hey James,****
>
>  ****
>
> I configured my IPA server with winsync and I was in the same boat as you.
> ****
>
>  ****
>
> The IPA user that is created for Active Directory does not require write
> access to AD.****
>
> My IPA user only has read permissions to the domain and my passwords sync
> just fine. When I delete a user from IPA it does not delete it from AD.***
> *
>
> ** **
>
> ** **
>
> ** **
>
> Thanks; good to know that there is a way to do this.  I really don't see
> where I am going wrong.  The user I use for synching will only work if I
> put it in the "administrator" group.  And when I do, I have a two way synch
> - if I remove an account on the IPA server, it "disappears" also in the AD
> - even though I did:****
>
>
> https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/managing-sync-agmt.html#unidirectional-sync
> ****
>
> ** **
>
> Do you by any chance have the specifics (permissions, groups etc.) of your
> user (in the AD) you use for synch'ing?****
>
> ** **
>
> thanks****
>
>
> /J****
>
> ** **
>
> ** **
>
> ** **
>
>  ****
>
>  ****
>
> Matt****
>
>  ****
>
> *From:* freeipa-users-bounces at redhat.com [mailto:
> freeipa-users-bounces at redhat.com] *On Behalf Of *Chris Hudson
> *Sent:* Tuesday, May 14, 2013 10:13 AM
> *To:* James A
> *Cc:* freeipa-users at redhat.com
> *Subject:* EXTERNAL: Re: [Freeipa-users] Syncing with AD****
>
>  ****
>
>  ****
>
> Hello all,****
>
>  ****
>
> I have been playing with trying to set up synchronization between windows
> AD --> IPA  following the instructions at****
>
>
> https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/index.html
> ****
>
>  ****
>
> A few questions arise;****
>
>  ****
>
> 1.) The documentation (specifically on
> https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/managing-sync-agmt.html),
> (under table 9.2) talks about options to the "ipa-replica-manage connect"
> command. Among others, --bindpw and --passsync.  With --binddn we specify
> the "full user DN of the synchronization identity" (and it's password with
> --bindpw ... but I fail to understand which users password should be used
> for "--passsync"??  Is it the same user?****
>
> The "--passsync" password is the password that you *will* use for the
> "passsync" user should you install the password synchronization package on
> your AD controllers. You are essentially setting this password preemptively.
> ****
>
>  ****
>
> 2.) The documentation says that the "synchronization identity" (see also
> above) must exist in the AD domain and "must have replicator, read, search
> and write permissions on the AD subtree.  What I am trying to do is create
> a one way sync from AD --> IPA  and I would really like to avoid using a
> user (for synching) that has write permissions (in the AD).  All my tries
> in setting up synchronization fails unless I add the synch-user to the
> group "Administrators". I have tried (and failed) using "account admins"
> etc.   Any pointers here would be great. Sorry for my ignorance when it
> comes to Windows. I am sure I am missing something obvious.****
>
>
> Someone else can probably comment on this, but the IPA server will need to
> bind to the AD controller and pull the necessary information from the
> directory...which makes these rights a necessity.****
>
>  ****
>
> 3.) I follow the instructions under "9.4.5" (
> https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/managing-sync-agmt.html#unidirectional-sync)
> to setup Uni-directional sync. (only AD --> IPA), and yet, when I go to
> remove an account in IPA it gets removed also in the AD.  (This I really
> want to avoid, thus the need for a read-only user to do the synchronization
> - see question 2).****
>
> I do not recall IPA ever removing users from AD. From what I remember,
> only certain attributes were bi-directional and deletes were not performed
> on AD. Has this changed?****
>
>  ****
>
>  ****
>
> All in all I think the FreeIPA project is amazing and it really gives us
> in the Linux community something we haven't had before.   If I can iron out
> the problems above I am sure it will become a great tool for me and my
> client.****
>
>
> Any input would be most appreciated.****
>
>  ****
>
> Thanks****
>
>  ****
>
> //James.****
>
>
> _______________________________________________
> Freeipa-users mailing list
> Freeipa-users at redhat.com
> https://www.redhat.com/mailman/listinfo/freeipa-users****
>
>  ****
>
> ** **
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20130514/5f1ac684/attachment.htm>


More information about the Freeipa-users mailing list