RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1044137 - [RFE] posix winsync should support ADD user/group entries from DS to AD
Summary: [RFE] posix winsync should support ADD user/group entries from DS to AD
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: 389-ds-base
Version: 7.0
Hardware: Unspecified
OS: Unspecified
medium
unspecified
Target Milestone: rc
: ---
Assignee: Rich Megginson
QA Contact: Viktor Ashirov
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-12-17 21:16 UTC by Nathan Kinder
Modified: 2023-12-15 15:46 UTC (History)
3 users (show)

Fixed In Version: 389-ds-base-1.3.3.1-1.el7
Doc Type: Enhancement
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-03-05 09:29:45 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github 389ds 389-ds-base issues 428 0 None closed posix winsync should support ADD user/group entries from DS to AD 2020-11-19 03:41:43 UTC
Red Hat Product Errata RHSA-2015:0416 0 normal SHIPPED_LIVE Important: 389-ds-base security, bug fix, and enhancement update 2015-03-05 14:26:33 UTC

Description Nathan Kinder 2013-12-17 21:16:26 UTC 
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/389/ticket/428

User/group entries added to DS do not have their posix attributes synced to AD.  This is due to a limitation in the winsync v1 api.  The v2 and later api support a pre add callback for DS to AD entries.
Comment 3 Noriko Hosoi 2014-10-28 20:43:26 UTC 
Docs:
https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/9.0/html/Administration_Guide/posix-sync.html
http://www.port389.org/docs/389ds/design/winsync-posix.html
http://www.port389.org/docs/389ds/design/posix-winsync-sid-enhancements.html

Please test these attribute paris:
    "unixHomeDirectory", "homeDirectory"
    "loginShell", "loginShell"
    "uidNumber", "uidNumber"
    "gidNumber", "gidNumber"
    "gecos", "gecos"
Comment 4 Viktor Ashirov 2015-01-19 17:13:34 UTC 
$ rpm -qa | grep 389
389-ds-base-debuginfo-1.3.3.1-11.el7.x86_64
389-ds-base-libs-1.3.3.1-11.el7.x86_64
389-ds-base-1.3.3.1-11.el7.x86_64

[1] Add user to DS with POSIX attributes:
$ ldapmodify -D "cn=Directory Manager" -w Secret123  -H ldap://localhost:1189 -a << EOF
dn: uid=ds_posixusr,ou=People,dc=example,dc=com
objectClass: inetorgperson
objectClass: inetuser
objectclass: ntUser
objectClass: posixAccount
uid: ds_posixusr
givenName: ds_posixusr
uidNumber: 1000
gidNumber: 1000
homeDirectory: /home/ds_posixusr
gecos: ds_posixusr
loginShell: /bin/bash
sn: ds_posixusr
cn: ds_posixusr
ntUserCreateNewAccount: true
ntUserDomainId: ds_posixusr
ntUserDeleteAccount: true
userPassword: Secret123
EOF
adding new entry "uid=ds_posixusr,ou=People,dc=example,dc=com"

[2] Add user to AD with POSIX attributes:
$ ldapadd -D "cn=Administrator,cn=users,dc=adrelm,dc=com" -w Secret123  -H ldaps://win2k8.adrelm.com:636  << EOF
dn: CN=ad_posixusr,ou=adsync,dc=adrelm,dc=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: posixAccount
uidNumber: 2000
gidNumber: 2000
cn: ad_posixusr
sn: ad_posixusr
uid: ad_posixusr
givenName: ad_posixusr
distinguishedName: CN=ad_posixusr,ou=adsync,dc=adrelm,dc=com
displayName: ad_posixusr
unixHomeDirectory: /home/ad_posixusr
loginShell: /bin/bash
gecos: ad_posixusr
sAMAccountName: ad_posixusr
userPrincipalName: ad_posixusr@dc=adrelm,dc=com
userAccountControl: 512
unicodePwd::IgBTAGUAYwByAGUAdAAxADIAMwA0ACIA
EOF
adding new entry "CN=ad_posixusr,ou=adsync,dc=adrelm,dc=com"

[3] Wait for sync

[4] Search for POSIX attributes of AD user synced to DS:
$ ldapsearch -o ldif-wrap=no -LLL -D "cn=Directory Manager" -w Secret123 -H ldap://localhost:1189 -b dc=example,dc=com uid=ad_posixusr uidNumber gidNumber unixHomeDirectory homeDirectory loginShell gecos
dn: uid=ad_posixusr,ou=People,dc=example,dc=com
uidNumber: 2000
gidNumber: 2000
homeDirectory: /home/ad_posixusr
loginShell: /bin/bash
gecos: ad_posixusr

[5] Search for POSIX attributes of DS user synced to AD:
$ ldapsearch -o ldif-wrap=no -LLL -D "cn=Administrator,cn=users,dc=adrelm,dc=com" -w Secret123  -H ldap://win2k8.adrelm.com -b dc=adrelm,dc=com cn=ds_posixusr uidNumber gidNumber unixHomeDirectory homeDirectory loginShell gecos
dn: CN=ds_posixusr,OU=adsync,DC=adrelm,DC=com
uidNumber: 1000
gidNumber: 1000
gecos: ds_posixusr
unixHomeDirectory: /home/ds_posixusr
loginShell: /bin/bash


Marking as VERIFIED
Comment 6 errata-xmlrpc 2015-03-05 09:29:45 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-0416.html
Note You need to log in before you can comment on or make changes to this bug.