Hide Forgot
This bug is created as a clone of upstream ticket: https://fedorahosted.org/freeipa/ticket/1904 Currently we plan to map Windows SIDs to Unix UID algorithmic (ID range for each domain, RID is added to the lowest ID in the range). But how shall we handle trusted domains where RFC2307 like attributes are already available, e.g. with Services for Unix (SfU) or the IdM for Unix in newer AD versions. On then one hand it would be irritating that a Windows user with a unix uid and gid will have a different uid and gid on a unix host. On the other hand a trust relationship means to make all users and groups available. And here we will most certainly fail if not all users and groups in a domain have the RFC2307 attributes and we take those form some users and groups and calculate them for the rest. So I think it would be better to not look at those attributes at all, but we have to underline this strongly in the documentation
I added a section here: http://documentation-stage.bne.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/about-sync-schema.html#windows-rfc2307-attributes
Fixed: http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/about-sync-schema.html#windows-rfc2307-attributes