Bug 839812 - winsync should not delete entry that appears to be out of scope
winsync should not delete entry that appears to be out of scope
Status: CLOSED DUPLICATE of bug 818762
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa (Show other bugs)
6.3
Unspecified Unspecified
high Severity high
: rc
: ---
Assigned To: Rob Crittenden
Namita Soman
:
Depends On: 818762
Blocks:
  Show dependency treegraph
 
Reported: 2012-07-12 18:39 EDT by Jr Aquino
Modified: 2012-10-16 13:37 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-10-16 13:37:58 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
FedoraHosted FreeIPA 355 None None None 2012-07-12 18:39:33 EDT

  None (edit)
Description Jr Aquino 2012-07-12 18:39:33 EDT
Description of problem:
WinSync currently deletes any matching user from 389 DS that it finds in a container outside of the configured container in AD.

Instead of deleting, I think we should just log a warning like
"Could not sync the AD entry %s with the DS entry %s, even though they have the same user id (or group id) %s, because the AD entry is out of scope %s of the windows sync agreement"
deleting perfectly good users is bad

see upstream ticket: https://fedorahosted.org/389/ticket/355

Version-Release number of selected component (if applicable):
1.2.10

How reproducible:
100%

Steps to Reproduce:
1. Configure 389 DS with duplicate users in AD & 389.  Place the duplicate AD users in a container B.
2. Configure 389 DS to utilize the WinSync plugin and configure it to look in Container A.
3. 389 will delete any matching user found inside of Container B.
  
Actual results:
Users are deleted

Expected results:
Perhaps a Warning error message indicating that users were found outside of the configured ldap container in Active Directory.

Additional info:
Comment 2 Dmitri Pal 2012-07-12 18:48:09 EDT
We are talking about the IPA version of the Winsync here. Changing component.
Comment 3 Rich Megginson 2012-07-12 18:49:00 EDT
(In reply to comment #2)
> We are talking about the IPA version of the Winsync here. Changing component.

Problem affects core 389 too, without IPA.
Comment 4 Dmitri Pal 2012-07-12 18:49:35 EDT
Upstream ticket:
https://fedorahosted.org/389/ticket/2927
Comment 5 Rich Megginson 2012-07-12 18:50:46 EDT
(In reply to comment #3)
> (In reply to comment #2)
> > We are talking about the IPA version of the Winsync here. Changing component.
> 
> Problem affects core 389 too, without IPA.

And the problem will have to be fixed in the core 389 winsync plugin.
Comment 6 Rich Megginson 2012-07-12 18:54:51 EDT
Upstream ticket:
https://fedorahosted.org/389/ticket/355
Comment 8 Martin Kosek 2012-07-13 02:34:28 EDT
(In reply to comment #4)
> Upstream ticket:
> https://fedorahosted.org/389/ticket/2927

This is a correct link to IPA upstream ticket:

https://fedorahosted.org/freeipa/ticket/2927
Comment 20 Rob Crittenden 2012-10-03 10:13:53 EDT
ipa spec file updated to pull in fixed version of 389-ds-base, 1.2.11.12.
Comment 21 Dmitri Pal 2012-10-16 13:37:58 EDT

*** This bug has been marked as a duplicate of bug 818762 ***

Note You need to log in before you can comment on or make changes to this bug.