On 08/22/2012 04:23 PM, Rich Megginson wrote:
On 08/22/2012 02:18 PM, Mark Reynolds wrote:
>
>
> On 08/22/2012 04:09 PM, Rich Megginson wrote:
>> Let's say you have a windows sync agreement
>> AD: cn=Users,dc=example,dc=com
>> DS: ou=People,dc=example,dc=com
>>
>> Let's say you also have another user container in AD:
>> cn=OtherUsers,dc=example,dc=com
>>
>> Let's say you have a user in AD in cn=Users in sync with a user in
>> DS in ou=People.
>>
>> What should happen if you move the user in AD from cn=Users to
>> cn=OtherUsers? Should DS "disconnect" the entry (i.e. remote the
>> ntuser attributes) so the entry is no longer in sync? Should
>> winsync do something else?
> Is it feasible to "mark" the entry as moved, or placed it in some
> kind of list, and then use a config option on whether to keep it in
> sync or not?
When we receive the AD entry in a search request, we will know if
there is a DS entry with the same userid, and whether or not the DS
entry is in sync (i.e. has the ntuser attributes).
Not sure what you mean by "mark" - maybe add some sort of attribute to
the DS entry that says "hey, this entry has the same userid as an
entry in AD but the AD entry is out of scope of the winsync agreement
and/or the DS entry is not set up to be a winsync entry"?
Yes, exactly. Maybe
something like: "winsyncPreviousScope: cn=People,
dc=example,dc=com"?
>>
>> Conversely, what should happen if a user is moved from cn=OtherUsers
>> to cn=Users? Should DS treat it as adding a new user or "connect"
>> an existing user if the userids match?
> Depending if it is "marked" or not, we would know what to do with it.
>>
>> --
>> 389 users mailing list
>> 389-users(a)lists.fedoraproject.org
>>
https://admin.fedoraproject.org/mailman/listinfo/389-users
>
--
Mark Reynolds
Senior Software Engineer
Red Hat, Inc
mreynolds(a)redhat.com