Kenneth Holter
2010-Jan-08 12:48 UTC
[389-users] Is changes to the UID attribute on the directory server synced back to AD when using Windows sync?
Hi. We''re using Windows sync on our (RedHat) directory server to fetch users from AD, and have a quick question about the UID attribute: It look to me like the UID attribute that linux ldap clients use for authentication, is a attribute created when one adds the posixaccount object class to the user object. In other words, when user "kenneth" is synced over from AD and I add the posixaccount object class, then the uid attribute is automatically created and populated with uid value "kenneth" from some (which one? "name"? "cn"?) AD attribute. Is this correct? If so, can I assume that making changes to the uid attribute will not be reflected on the AD side? Best regards, Kenneth Holter
Rich Megginson
2010-Jan-08 15:19 UTC
Re: [389-users] Is changes to the UID attribute on the directory server synced back to AD when using Windows sync?
Kenneth Holter wrote:> Hi. > > > We''re using Windows sync on our (RedHat) directory server to fetch > users from AD, and have a quick question about the UID attribute: It > look to me like the UID attribute that linux ldap clients use for > authentication, is a attribute created when one adds the posixaccount > object class to the user object. In other words, when user "kenneth" > is synced over from AD and I add the posixaccount object class, then > the uid attribute is automatically created and populated with uid > value "kenneth" from some (which one? "name"? "cn"?) AD attribute. Is > this correct?Yes. The AD attribute samAccountName is used to populate the uid attribute on 389.> If so, can I assume that making changes to the uid attribute will not > be reflected on the AD side?I''m not sure. uid and samAccountName are "special" attributes - not sure if they are synced - you could try it I suppose.> > > Best regards, > Kenneth Holter > > > > > ------------------------------------------------------------------------ > > -- > 389 users mailing list > 389-users@redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users >
James Roman
2010-Jan-08 16:03 UTC
Re: [389-users] Is changes to the UID attribute on the directory server synced back to AD when using Windows sync?
Rich Megginson wrote:> Kenneth Holter wrote: >> Hi. >> >> >> We''re using Windows sync on our (RedHat) directory server to fetch >> users from AD, and have a quick question about the UID attribute: It >> look to me like the UID attribute that linux ldap clients use for >> authentication, is a attribute created when one adds the posixaccount >> object class to the user object. In other words, when user "kenneth" >> is synced over from AD and I add the posixaccount object class, then >> the uid attribute is automatically created and populated with uid >> value "kenneth" from some (which one? "name"? "cn"?) AD attribute. Is >> this correct? > Yes. The AD attribute samAccountName is used to populate the uid > attribute on 389. >> If so, can I assume that making changes to the uid attribute will not >> be reflected on the AD side? > I''m not sure. uid and samAccountName are "special" attributes - not > sure if they are synced - you could try it I suppose.We normally see the following: 1. AD Account created 2. FreeIPA winsync sees the new account and creates a new user based on the samAccountName (so the uid value is = to samaccountname AND ntuserdomainid=samaccountname) 3. winsync runs again and the uid attribute is written to the AD record. 4. if you change the uid in freeipa, winsync will change the uid value for the AD record, but not the samaccountname. 5. if you change the ntuserdomainid in freeipa, then the account will no longer sync. (So make sure you change the samaccountname in AD next.)>> >> >> Best regards, >> Kenneth Holter >> >> >> >> >> ------------------------------------------------------------------------ >> >> -- >> 389 users mailing list >> 389-users@redhat.com >> https://www.redhat.com/mailman/listinfo/fedora-directory-users >> > > -- > 389 users mailing list > 389-users@redhat.com > https://www.redhat.com/mailman/listinfo/fedora-directory-users