Bug 839812

Summary:	winsync should not delete entry that appears to be out of scope
Product:	Red Hat Enterprise Linux 6	Reporter:	Jr Aquino <jr.aquino>
Component:	ipa	Assignee:	Rob Crittenden <rcritten>
Status:	CLOSED DUPLICATE	QA Contact:	Namita Soman <nsoman>
Severity:	high	Docs Contact:
Priority:	high
Version:	6.3	CC:	dpal, jgalipea, mkosek, pdemmers, rmeggins
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-10-16 17:37:58 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	818762
Bug Blocks:

Description Jr Aquino 2012-07-12 22:39:33 UTC

Description of problem:
WinSync currently deletes any matching user from 389 DS that it finds in a container outside of the configured container in AD.

Instead of deleting, I think we should just log a warning like
"Could not sync the AD entry %s with the DS entry %s, even though they have the same user id (or group id) %s, because the AD entry is out of scope %s of the windows sync agreement"
deleting perfectly good users is bad

see upstream ticket: https://fedorahosted.org/389/ticket/355

Version-Release number of selected component (if applicable):
1.2.10

How reproducible:
100%

Steps to Reproduce:
1. Configure 389 DS with duplicate users in AD & 389.  Place the duplicate AD users in a container B.
2. Configure 389 DS to utilize the WinSync plugin and configure it to look in Container A.
3. 389 will delete any matching user found inside of Container B.
  
Actual results:
Users are deleted

Expected results:
Perhaps a Warning error message indicating that users were found outside of the configured ldap container in Active Directory.

Additional info:

Comment 2 Dmitri Pal 2012-07-12 22:48:09 UTC

We are talking about the IPA version of the Winsync here. Changing component.

Comment 3 Rich Megginson 2012-07-12 22:49:00 UTC

(In reply to comment #2)
> We are talking about the IPA version of the Winsync here. Changing component.

Problem affects core 389 too, without IPA.

Comment 4 Dmitri Pal 2012-07-12 22:49:35 UTC

Upstream ticket:
https://fedorahosted.org/389/ticket/2927

Comment 5 Rich Megginson 2012-07-12 22:50:46 UTC

(In reply to comment #3)
> (In reply to comment #2)
> > We are talking about the IPA version of the Winsync here. Changing component.
> 
> Problem affects core 389 too, without IPA.

And the problem will have to be fixed in the core 389 winsync plugin.

Comment 6 Rich Megginson 2012-07-12 22:54:51 UTC

Upstream ticket:
https://fedorahosted.org/389/ticket/355

Comment 8 Martin Kosek 2012-07-13 06:34:28 UTC

(In reply to comment #4)
> Upstream ticket:
> https://fedorahosted.org/389/ticket/2927

This is a correct link to IPA upstream ticket:

https://fedorahosted.org/freeipa/ticket/2927

Comment 20 Rob Crittenden 2012-10-03 14:13:53 UTC

ipa spec file updated to pull in fixed version of 389-ds-base, 1.2.11.12.

Comment 21 Dmitri Pal 2012-10-16 17:37:58 UTC


*** This bug has been marked as a duplicate of bug 818762 ***