#2927 winsync should not delete entry that appears to be out of scope
Closed: Fixed None Opened 11 years ago by dpal.

https://bugzilla.redhat.com/show_bug.cgi?id=839812 (Red Hat Enterprise Linux 6)

Description of problem:
WinSync currently deletes any matching user from 389 DS that it finds in a
container outside of the configured container in AD.

Instead of deleting, I think we should just log a warning like
"Could not sync the AD entry %s with the DS entry %s, even though they have the
same user id (or group id) %s, because the AD entry is out of scope %s of the
windows sync agreement"
deleting perfectly good users is bad

see upstream ticket: https://fedorahosted.org/389/ticket/355

Version-Release number of selected component (if applicable):
1.2.10

How reproducible:
100%

Steps to Reproduce:
1. Configure 389 DS with duplicate users in AD & 389.  Place the duplicate AD
users in a container B.
2. Configure 389 DS to utilize the WinSync plugin and configure it to look in
Container A.
3. 389 will delete any matching user found inside of Container B.

Actual results:
Users are deleted

Expected results:
Perhaps a Warning error message indicating that users were found outside of the
configured ldap container in Active Directory.

Additional info:

Tracking of the DS work.

Fixed in 1.2.11.12.

This is currently already required by IPA, marking as fixed.

Metadata Update from @dpal:
- Issue assigned to rcritten
- Issue set to the milestone: FreeIPA 3.0 RC2

7 years ago

Login to comment on this ticket.

Metadata