Bug 1044137 - [RFE] posix winsync should support ADD user/group entries from DS to AD
Summary: [RFE] posix winsync should support ADD user/group entries from DS to AD
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: 389-ds-base
Version: 7.0
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Rich Megginson
QA Contact: Viktor Ashirov
Depends On:
TreeView+ depends on / blocked
Reported: 2013-12-17 21:16 UTC by Nathan Kinder
Modified: 2020-11-19 21:54 UTC (History)
3 users (show)

Fixed In Version: 389-ds-base-
Doc Type: Enhancement
Doc Text:
Clone Of:
Last Closed: 2015-03-05 09:29:45 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github 389ds 389-ds-base issues 428 0 None closed posix winsync should support ADD user/group entries from DS to AD 2020-11-19 03:41:43 UTC
Red Hat Product Errata RHSA-2015:0416 0 normal SHIPPED_LIVE Important: 389-ds-base security, bug fix, and enhancement update 2015-03-05 14:26:33 UTC

Description Nathan Kinder 2013-12-17 21:16:26 UTC
This bug is created as a clone of upstream ticket:

User/group entries added to DS do not have their posix attributes synced to AD.  This is due to a limitation in the winsync v1 api.  The v2 and later api support a pre add callback for DS to AD entries.

Comment 3 Noriko Hosoi 2014-10-28 20:43:26 UTC

Please test these attribute paris:
    "unixHomeDirectory", "homeDirectory"
    "loginShell", "loginShell"
    "uidNumber", "uidNumber"
    "gidNumber", "gidNumber"
    "gecos", "gecos"

Comment 4 Viktor Ashirov 2015-01-19 17:13:34 UTC
$ rpm -qa | grep 389

[1] Add user to DS with POSIX attributes:
$ ldapmodify -D "cn=Directory Manager" -w Secret123  -H ldap://localhost:1189 -a << EOF
dn: uid=ds_posixusr,ou=People,dc=example,dc=com
objectClass: inetorgperson
objectClass: inetuser
objectclass: ntUser
objectClass: posixAccount
uid: ds_posixusr
givenName: ds_posixusr
uidNumber: 1000
gidNumber: 1000
homeDirectory: /home/ds_posixusr
gecos: ds_posixusr
loginShell: /bin/bash
sn: ds_posixusr
cn: ds_posixusr
ntUserCreateNewAccount: true
ntUserDomainId: ds_posixusr
ntUserDeleteAccount: true
userPassword: Secret123
adding new entry "uid=ds_posixusr,ou=People,dc=example,dc=com"

[2] Add user to AD with POSIX attributes:
$ ldapadd -D "cn=Administrator,cn=users,dc=adrelm,dc=com" -w Secret123  -H ldaps://win2k8.adrelm.com:636  << EOF
dn: CN=ad_posixusr,ou=adsync,dc=adrelm,dc=com
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: posixAccount
uidNumber: 2000
gidNumber: 2000
cn: ad_posixusr
sn: ad_posixusr
uid: ad_posixusr
givenName: ad_posixusr
distinguishedName: CN=ad_posixusr,ou=adsync,dc=adrelm,dc=com
displayName: ad_posixusr
unixHomeDirectory: /home/ad_posixusr
loginShell: /bin/bash
gecos: ad_posixusr
sAMAccountName: ad_posixusr
userPrincipalName: ad_posixusr@dc=adrelm,dc=com
userAccountControl: 512
adding new entry "CN=ad_posixusr,ou=adsync,dc=adrelm,dc=com"

[3] Wait for sync

[4] Search for POSIX attributes of AD user synced to DS:
$ ldapsearch -o ldif-wrap=no -LLL -D "cn=Directory Manager" -w Secret123 -H ldap://localhost:1189 -b dc=example,dc=com uid=ad_posixusr uidNumber gidNumber unixHomeDirectory homeDirectory loginShell gecos
dn: uid=ad_posixusr,ou=People,dc=example,dc=com
uidNumber: 2000
gidNumber: 2000
homeDirectory: /home/ad_posixusr
loginShell: /bin/bash
gecos: ad_posixusr

[5] Search for POSIX attributes of DS user synced to AD:
$ ldapsearch -o ldif-wrap=no -LLL -D "cn=Administrator,cn=users,dc=adrelm,dc=com" -w Secret123  -H ldap://win2k8.adrelm.com -b dc=adrelm,dc=com cn=ds_posixusr uidNumber gidNumber unixHomeDirectory homeDirectory loginShell gecos
dn: CN=ds_posixusr,OU=adsync,DC=adrelm,DC=com
uidNumber: 1000
gidNumber: 1000
gecos: ds_posixusr
unixHomeDirectory: /home/ds_posixusr
loginShell: /bin/bash

Marking as VERIFIED

Comment 6 errata-xmlrpc 2015-03-05 09:29:45 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.