Bug 1049029

Summary:	Windows Sync group issues
Product:	Red Hat Enterprise Linux 6	Reporter:	Noriko Hosoi <nhosoi>
Component:	389-ds-base	Assignee:	Rich Megginson <rmeggins>
Status:	CLOSED ERRATA	QA Contact:	Sankar Ramalingam <sramling>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.4	CC:	jgalipea, mkubik
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	389-ds-base-1.2.11.15-34.el6	Doc Type:	Bug Fix
Doc Text:	Cause: When an entry is moved on AD, and the entry is a member of a group, the value of the member in the group is automatically updated. But Windows Sync Control request only returns the renamed entry; it does not return the group having the member in it even though the value is updated. This is because an AD group stores DNT (Distinguish Name Tag -- ID in integer) instead of the dn itself. Since the rename operation does not change DNT, the group entry on AD has no change, either. On the DS side, the group entry stores the full DN which needs to be adjusted to the renamed DN to complete the synchronization with AD. Consequence: Renaming user DN on AD is not applied to the synced member DN in a group that the user DN belongs to on the DS. Fix: Once rename operation is received from AD, Windows Sync code searches groups having a member value matches the pre-renamed dn on DS, and replaces the old dn with the renamed one. Result: The renamed member DN in a group is also updated as expected on the DS.	Story Points:	---
Clone Of:
Clones:	1049030 (view as bug list)		Environment:
Last Closed:	2014-10-14 07:52:45 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1049030, 1061410

Description Noriko Hosoi 2014-01-06 20:02:16 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/389/ticket/47642

version: 389-Directory/1.2.11.25 B2013.347.1221

389DS <--> Windows 2008 R2

Name of group: GSG_TESTE

Included a lot of users on this group, including this user:

choose a user to test
DN of the user on windows: CN=Alberto Viana,OU=TESTE,DC=homolog,DC=rnp
DN  of the user on 389DS: uid=alberto.viana,ou=TESTE,dc=homolog,dc=rnp

What I did:

Changeg the OU of the user via windows to:
NEW DN: CN=Alberto Viana,OU=NEW,DC=homolog,DC=rnp


What happenned:
Did not deleted all users from the group.
389DS moved correctly the user to new DN: uid=alberto.viana,ou=NEW,dc=homolog,dc=rnp
389DS Added this new uid (uid=alberto.viana,ou=NEW,dc=homolog,dc=rnp) to group, but keep the old entry too (uid=alberto.viana,ou=TESTE,dc=homolog,dc=rnp).

Whe I remove the old entry manually (uid=alberto.viana,ou=TESTE,dc=homolog,dc=rnp) from the group, 389 DS deletes all users from the group on both sides (389DS and windows)

Just to let you know that I have others versions of 389DS running (389-Directory/1.3.1.3 and 389-Directory/1.2.10.12), and just the fact to change the DN/OU of one user in a group, deletes all users from this group (not from 389 DS).

Comment 2 Noriko Hosoi 2014-06-27 00:12:35 UTC

STEPS:
On AD:
Prepare a group having a user as a member.
Move the member to a new location (e.g, under a different organizational unit.  please note that the ou has to be in the sync target subtree.)

On DS:
Click: "Send and Receive Updates Now" on the WinSync agreement icon on the DS Console.
Check the member (uniquemember) in the group.
If the DN of the uniquemember is adjusted to the new location, this bug is verified.

Comment 4 errata-xmlrpc 2014-10-14 07:52:45 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1385.html