Red Hat Bugzilla – Bug 839812
winsync should not delete entry that appears to be out of scope
Last modified: 2012-10-16 13:37:58 EDT
Description of problem:
WinSync currently deletes any matching user from 389 DS that it finds in a container outside of the configured container in AD.
Instead of deleting, I think we should just log a warning like
"Could not sync the AD entry %s with the DS entry %s, even though they have the same user id (or group id) %s, because the AD entry is out of scope %s of the windows sync agreement"
deleting perfectly good users is bad
see upstream ticket: https://fedorahosted.org/389/ticket/355
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Configure 389 DS with duplicate users in AD & 389. Place the duplicate AD users in a container B.
2. Configure 389 DS to utilize the WinSync plugin and configure it to look in Container A.
3. 389 will delete any matching user found inside of Container B.
Users are deleted
Perhaps a Warning error message indicating that users were found outside of the configured ldap container in Active Directory.
We are talking about the IPA version of the Winsync here. Changing component.
(In reply to comment #2)
> We are talking about the IPA version of the Winsync here. Changing component.
Problem affects core 389 too, without IPA.
(In reply to comment #3)
> (In reply to comment #2)
> > We are talking about the IPA version of the Winsync here. Changing component.
> Problem affects core 389 too, without IPA.
And the problem will have to be fixed in the core 389 winsync plugin.
(In reply to comment #4)
> Upstream ticket:
This is a correct link to IPA upstream ticket:
ipa spec file updated to pull in fixed version of 389-ds-base, 18.104.22.168.
*** This bug has been marked as a duplicate of bug 818762 ***