Show Table of Contents
16.8. Configuring Multiple Subtrees and Filters in Windows Synchronization
Windows Synchronization is designed to synchronize between multiple pairs of subtrees on the Directory Server (DS) and Active Directory (AD). By using filters, only specified entries under a subtree are synchronized.
Multiple Subtrees in Windows Synchronization
To synchronize among multiple subtree pairs, configure the Directory Server and the Active Directory subtrees in the
winSyncSubtreePair
parameter in the Windows sync agreement. Use ldapmodify
to set multiple subtrees as follows:
changetype: modify add: winSyncSubtreePair winSyncSubtreePair: ou=OU1,dc=DSexample,dc=com:ou=OU1,DC=ADexample,DC=com
If
winSyncSubtreePair
is not set, the nsds7WindowsReplicaSubtree
AD subtree parameter and the nsds7DirectoryReplicaSubtree
DS subtree parameter are used for the synchronization target checks instead. Otherwise, these two parameters are ignored.
Filters in Windows Synchronization
You can set a filter that selects data to be synchronized in the following parameters:
winSyncWindowsFilter
sets an additional filter on the Active Directory server,winSyncDirectoryFilter
parameter sets an additional filter on the Directory Server.
In the following example,
ldapmodify
is used to synchronize entries whose CN contains user
or group
:
changetype: modify add: winSyncWindowsFilter winSyncWindowsFilter: (|(cn=*user*)(cn=*group*)) - add: winSyncDirectoryFilter winSyncDirectoryFilter: (|(uid=*user*)(cn=*group*))