https://bugzilla.redhat.com/show_bug.cgi?id=839812 (Red Hat Enterprise Linux 6)
Description of problem: WinSync currently deletes any matching user from 389 DS that it finds in a container outside of the configured container in AD. Instead of deleting, I think we should just log a warning like "Could not sync the AD entry %s with the DS entry %s, even though they have the same user id (or group id) %s, because the AD entry is out of scope %s of the windows sync agreement" deleting perfectly good users is bad see upstream ticket: https://fedorahosted.org/389/ticket/355 Version-Release number of selected component (if applicable): 1.2.10 How reproducible: 100% Steps to Reproduce: 1. Configure 389 DS with duplicate users in AD & 389. Place the duplicate AD users in a container B. 2. Configure 389 DS to utilize the WinSync plugin and configure it to look in Container A. 3. 389 will delete any matching user found inside of Container B. Actual results: Users are deleted Expected results: Perhaps a Warning error message indicating that users were found outside of the configured ldap container in Active Directory. Additional info:
Tracking of the DS work.
https://fedorahosted.org/389/ticket/355
Fixed in 1.2.11.12.
This is currently already required by IPA, marking as fixed.
Metadata Update from @dpal: - Issue assigned to rcritten - Issue set to the milestone: FreeIPA 3.0 RC2
Login to comment on this ticket.