Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
When the posix attributes and objectClass are deleted from Active Directory with Windows sync and Winsync POSIX plugin active, this change is not synchronized to DS.
Version-Release number of selected component (if applicable):
389-ds-base-1.2.11.15-10
How reproducible:
Steps to Reproduce:
1. Set up Windows synchronization and POSIX Windows Sync plugin
2. Add user or group entry with POSIX attributes
3. Delete POSIX attributes and entry's respective objectClass from AD
4. After sync (dependent on sync agreement) check the entry on DS
Actual results:
Attributes are not changed. Applies to both posixAccount and posixGroup object classes and their respective attributes.
Expected results:
Attributes and object class should be deleted.
Additional info:
As mentioned in [1], there is no backlog for changes on AD. In that case the posix winsync plugin iterates over the attributes in the actual active directory entry. When the posix attributes are deleted, plugin can't iterate over them and the attributes on DS entry are left unchanged.
[1]: https://github.com/cgrzemba/Posix-Winsync-Plugin-for-389-directory-server/blob/master/posix-winsync.c
I think it should stay this way. The use case might be that AD had posix attributes, they were synced to DS or IPA and then the AD was cleaned. I do not think it is a good idea to clean the DS or IPA data when the AD posix attributes are removed. IMO this should be just documented that the feature works as is.
If the DS entry is updated again after step 4, do the POSIX attributes show back up in AD, or does AD still not have the POSIX attributes?
I agree with Dmitri that there is a use case for wanting the current behavior, which would be the case if one were trying to migrate the management of POSIX attributes from AD to DS.
I think we should document the way that the feature works and wait to see if there is a customer request to add support for sync of POSIX attribute deletion. If a customer has a use case for it, then we can evaluate putting it on the roadmap.
We could just go ahead and add another configuration switch e.g.
posixDeletePosixAttrs: true - will sync the deletion of the AD posix objectclass and attributes to DS
false will maintain the current behavior and the default will be false
Comment 6Sankar Ramalingam
2013-02-26 11:11:29 UTC
(In reply to comment #3)
> If the DS entry is updated again after step 4, do the POSIX attributes show
> back up in AD, or does AD still not have the POSIX attributes?
It doesn't show up posix attributes. After step #4, I ran an ldapmodify on DS to change the "sn" attribute and the same synced to AD, but no other changes for posixAccount objectClass or posix attributes done.
>
> I agree with Dmitri that there is a use case for wanting the current
> behavior, which would be the case if one were trying to migrate the
> management of POSIX attributes from AD to DS.
>
> I think we should document the way that the feature works and wait to see if
> there is a customer request to add support for sync of POSIX attribute
> deletion. If a customer has a use case for it, then we can evaluate putting
> it on the roadmap.