ldap/servers/plugins/replication/windows_protocol_util.c | 17 +++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
New commits:
commit 3bb70c18739f8f7a04a2382ae7ffcb7d7bc68ec9
Author: Rich Megginson <rmeggins(a)redhat.com>
Date: Thu Apr 28 13:29:55 2011 -0600
Bug 694336 - Group sync hangs Windows initial Sync
https://bugzilla.redhat.com/show_bug.cgi?id=694336
Resolves: bug 694336
Bug Description: Group sync hangs Windows initial Sync
Reviewed by: rmeggins (Author: diego(a)woitasen.com.ar)
Branch: 389-ds-base-1.2.8
Fix Description: winsync was getting back an error 65 (object class violation)
attempting to add the userAccountControl attribute to a group entry.
Only do this for user entries. I modified the patch slightly to change the
formatting, and to use "is_user" rather than "!is_group" to test
whether
or not to send the userAccountControl attribute.
Platforms tested: RHEL6 x86_64, Windows 2008 r2
Flag Day: no
Doc impact: no
(cherry picked from commit c2c82cb46417f033f5a8e1bb2cef58cfb29e82b6)
diff --git a/ldap/servers/plugins/replication/windows_protocol_util.c
b/ldap/servers/plugins/replication/windows_protocol_util.c
index abcdbc3..dc49827 100644
--- a/ldap/servers/plugins/replication/windows_protocol_util.c
+++ b/ldap/servers/plugins/replication/windows_protocol_util.c
@@ -928,8 +928,12 @@ windows_entry_has_attr_and_value(Slapi_Entry *e, const char
*attrname, char *val
static void
windows_is_local_entry_user_or_group(Slapi_Entry *e, int *is_user, int *is_group)
{
- *is_user =
windows_entry_has_attr_and_value(e,"objectclass","ntuser");
- *is_group =
windows_entry_has_attr_and_value(e,"objectclass","ntgroup");
+ if (is_user) {
+ *is_user = windows_entry_has_attr_and_value(e, "objectclass",
"ntuser");
+ }
+ if (is_group) {
+ *is_group = windows_entry_has_attr_and_value(e, "objectclass",
"ntgroup");
+ }
}
static void
@@ -1621,8 +1625,10 @@ windows_replay_update(Private_Repl_Protocol *prp,
slapi_operation_parameters *op
* userAccountControl: 512
* Or, if we added a new entry, we need to change the useraccountcontrol
* to make the new user enabled by default
+ * it is assumed that is_user is set for user entries and that only user entries need
+ * accountcontrol values
*/
- if ((return_value == CONN_OPERATION_SUCCESS) && remote_dn && (password
|| missing_entry)) {
+ if ((return_value == CONN_OPERATION_SUCCESS) && remote_dn && (password
|| missing_entry) && is_user) {
return_value = send_accountcontrol_modify(remote_dn, prp, missing_entry);
}
} else {
@@ -4510,6 +4516,7 @@ windows_process_total_add(Private_Repl_Protocol *prp,Slapi_Entry *e,
Slapi_DN* r
int can_add = winsync_plugin_call_can_add_entry_to_ad_cb(prp->agmt, e, remote_dn);
/* First map the entry */
local_dn = slapi_entry_get_sdn_const(e);
+ int is_user;
if (missing_entry) {
if (can_add) {
retval = windows_create_remote_entry(prp, e, remote_dn, &mapped_entry,
&password);
@@ -4540,7 +4547,9 @@ windows_process_total_add(Private_Repl_Protocol *prp,Slapi_Entry *e,
Slapi_DN* r
ldap_mods_free(entryattrs, 1);
entryattrs = NULL;
- if (retval == 0) { /* set the account control bits */
+ windows_is_local_entry_user_or_group(e, &is_user, NULL);
+ if ((retval == 0) && is_user) {
+ /* set the account control bits only for users */
retval = send_accountcontrol_modify(remote_dn, prp, missing_entry);
}
}