[Fedora-directory-users] RHDS and winsync... how to sync disablement of users

[Aaron Oas]

I have a Win2003 AD server and a RHDS 8.0 server, with a windows sync
agreement between them.  The SSL, win sync agreement and the password
sync are all working fine.

Our intent is to do core user management from one place: AD, and then
have various apps and linux hosts using the RHDS server as needed.

One of the key user management functions is disabling an account when
the person leaves.  We don't want to delete accounts, because you lose
some ability to trace ownership after the fact etc.

Using the "disable account" option in AD does not carry over, since AD
just stores that flag in a bitmask type of attribute
(userAccountControl), and winsync does not map that attribute (not
surprisingly since the attribute is ugly).  

Expiring the account in AD also doesn't work.  It seems to map
improperly in the winsync mapping: the time value that ends up on the
RHDS side is translated wildy inaccurately in the RHDS console (hundreds
of years off).

I am looking at writing a perl daemon to watch AD, pull the "user
disabled" value from the userAccountControl attributes of all the users
in AD, then map that to the nsaccountlock attribute in RHDS.  This
includes resulting woes of: do I try to track changes and see which side
made the change first (i.e. AD -> DS   versus   DS -> AD)?  Or do I just
take the "easy" way out and assume AD is right, etc. etc.

Is there any better way to sync the disabling of accounts between AD and
RHDS/FDS?


Aaron Oas

[Ivan Ferreira]

Maybe if you create a script that modifies both directories at the same
time can help.

For example, on Windows you can run:

dsmod user <user's DN> -disabled yes

You can modify the user attributes in FDS with ldapmodify. There is also
ldapmodify.exe than can run on Windows.

http://www.novell.com/coolsolutions/feature/5993.html



                                                                           
                                                                           
                                                                           
                                                                      Para 
                                          <fedora-directory-users(a)redhat.c 
                                          om>                              
       "Aaron Oas"                                                      cc 
       <AOas(a)redbrickhealth.com                                            
>                                                             Asunto 
       Enviado por:                       [Fedora-directory-users] RHDS    
       fedora-directory-users-b           and winsync... how to sync       
       ounces(a)redhat.com                  disablement of users             
                                                             Clasificación 
       13/02/2008 07:28 p.m.             Uso Interno                       
                                                                           
                                                                           
                                                                           
        Por favor, responda a                                              
       "General discussion list                                            
       for the Fedora Directory                                            
           server project."                                                
       <fedora-directory-users@                                            
             redhat.com>                                                   
                                                                           
                                                                           




I have a Win2003 AD server and a RHDS 8.0 server, with a windows sync
agreement between them.  The SSL, win sync agreement and the password
sync are all working fine.

Our intent is to do core user management from one place: AD, and then
have various apps and linux hosts using the RHDS server as needed.

One of the key user management functions is disabling an account when
the person leaves.  We don't want to delete accounts, because you lose
some ability to trace ownership after the fact etc.

Using the "disable account" option in AD does not carry over, since AD
just stores that flag in a bitmask type of attribute
(userAccountControl), and winsync does not map that attribute (not
surprisingly since the attribute is ugly).

Expiring the account in AD also doesn't work.  It seems to map
improperly in the winsync mapping: the time value that ends up on the
RHDS side is translated wildy inaccurately in the RHDS console (hundreds
of years off).

I am looking at writing a perl daemon to watch AD, pull the "user
disabled" value from the userAccountControl attributes of all the users
in AD, then map that to the nsaccountlock attribute in RHDS.  This
includes resulting woes of: do I try to track changes and see which side
made the change first (i.e. AD -> DS   versus   DS -> AD)?  Or do I just
take the "easy" way out and assume AD is right, etc. etc.

Is there any better way to sync the disabling of accounts between AD and
RHDS/FDS?


Aaron Oas


--
Fedora-directory-users mailing list
Fedora-directory-users(a)redhat.com
https://www.redhat.com/mailman/listinfo/fedora-directory-users


========================================================================================
AVISO LEGAL: Esta información es privada y confidencial y está dirigida
únicamente a su destinatario. Si usted no es el destinatario original de
este mensaje y por este medio pudo  acceder a dicha información por favor
elimine el mensaje. La distribución o copia de este mensaje está
estrictamente prohibida. Esta comunicación es sólo para  propósitos de
información y no debe ser considerada como propuesta, aceptación ni como
una declaración de voluntad oficial de NUCLEO S.A.  La transmisión de
e-mails no garantiza que el correo electrónico sea seguro o libre de error.
Por consiguiente, no manifestamos que esta información sea completa o
precisa.  Toda información está sujeta a alterarse sin previo aviso.

 This information is private and confidential and intended for the
recipient only. If you are not the intended recipient of this message you
are hereby notified that any review,  dissemination, distribution or
copying of this message is strictly prohibited. This communication is for
information purposes only and shall not be regarded neither as a proposal,
acceptance nor as a statement of will or official statement from NUCLEO
S.A. . Email transmission cannot be guaranteed to be secure or error-free.
Therefore,  we do not represent that this information is complete or
accurate and it should not be relied upon as such. All information is
subject to change without notice.