Hide Forgot
Description of problem: When Windows Active Directory Users are synced to IPA server, the AD user is not added as a member of "ipausers" . As per the ipa-winsync configuration on ipa server, ipawinsyncdefaultgroupattr: ipaDefaultPrimaryGroup and ipaDefaultPrimaryGroup is "ipausers" dn: cn=ipa-winsync,cn=plugins,cn=config objectClass: top objectClass: nsSlapdPlugin objectClass: extensibleObject cn: ipa-winsync nsslapd-pluginPath: libipa_winsync nsslapd-pluginInitfunc: ipa_winsync_plugin_init nsslapd-pluginDescription: ipa winsync plugin nsslapd-pluginId: ipa-winsync-plugin nsslapd-pluginVersion: FreeIPA/1.0 nsslapd-pluginVendor: FreeIPA project nsslapd-pluginType: preoperation nsslapd-pluginEnabled: on nsslapd-plugin-depends-on-type: database ipawinsyncrealmfilter: (objectclass=krbRealmContainer) ipawinsyncrealmattr: cn ipawinsyncnewentryfilter: (cn=ipaConfig) ipawinsyncnewuserocattr: ipauserobjectclasses ipawinsyncuserflatten: true ipawinsynchomedirattr: ipaHomesRootDir ipawinsyncloginshellattr: ipaDefaultLoginShell ipawinsyncdefaultgroupattr: ipaDefaultPrimaryGroup ipawinsyncdefaultgroupfilter: (gidNumber=*)(objectclass=posixGroup)(objectclas s=groupOfNames) ipawinsyncacctdisable: both ipawinsyncforcesync: true ipawinsyncuserattr: uidNumber 999 ipawinsyncuserattr: gidNumber 999 After the AD user is synced, the gidNumber is same as the uidNumber i.e alloted to AD User. Example, Below is the entry of the ADUser that is synced from Windows 2008 Server. dn: uid=rhipauser1,cn=users,cn=accounts,dc=iris,dc=gsslab,dc=pnq,dc=redhat,dc= com mepManagedEntry: cn=rhipauser1,cn=groups,cn=accounts,dc=iris,dc=gsslab,dc=pnq, dc=redhat,dc=com objectClass: top objectClass: person objectClass: organizationalperson objectClass: inetOrgPerson objectClass: ntUser objectClass: inetuser objectClass: posixaccount objectClass: krbprincipalaux objectClass: krbticketpolicyaux objectClass: ipaobject objectClass: mepOriginEntry ntUserDeleteAccount: true uid: rhipauser1 sn: user1 givenName: rhipa initials: rh cn: rhipauser1 ntUserCodePage: 0 ntUserAcctExpires: 9223372036854775807 ntUserDomainId: rhipauser1 ntUniqueId: 3ac04b5c42927642b4531edf54072c3f krbPrincipalName: rhipauser1@IRIS.GSSLAB.PNQ.REDHAT.COM homeDirectory: /home/rhipauser1 gecos: rhipauser1 loginShell: /bin/sh uidNumber: 1297200004 gidNumber: 1297200004 ipaUniqueID: f75d6f70-494e-11e1-a08b-5254005a4de1 Version-Release number of selected component (if applicable): ipa-server-2.1.3-9.el6.x86_64 How reproducible: Steps to Reproduce: 1. Configure Windows AD Sync ipa-replica-manage connect --winsync --binddn cn=rhipasyncuser,cn=Users,dc=iris,dc=gsslab,dc=pnq,dc=redhat,dc=com --bindpw 1redsmB --passsync redhat@123 --cacert /etc/openldap/cacerts/certnew.cer --win-subtree ou=ipa,dc=iris,dc=gsslab,dc=pnq,dc=redhat,dc=com irene.iris.gsslab.pnq.redhat.com -v 2. Create users on AD under "ou=ipa,dc=iris,dc=gsslab,dc=pnq,dc=redhat,dc=com " on Windows Server. 3. The AD user on IPA will not be a member of "ipausers" group Actual results: The AD user on IPA will not be a member of "ipausers" group Expected results: The AD user on IPA should be a member of "ipausers" group Additional info:
Upstream ticket: https://fedorahosted.org/freeipa/ticket/2324
Thank you taking your time and submitting this request for Red Hat Enterprise Linux. Unfortunately, this bug was not given a priority and was deferred both in the upstream project and in Red Hat Enterprise Linux. Given that we are unable to fulfill this request in following Red Hat Enterprise Linux releases, I am closing the Bugzilla as DEFERRED. To request that Red Hat re-considers the decision, please re-open the Bugzilla via appropriate support channels and provide additional business and/or technical details about its importance to you. Note that you can still track this request or even contribute patches in the referred upstream Trac ticket.