Language and Page Formatting Options
16.9. Synchronizing POSIX Attributes for Users and Groups
A subset of all possible user and attributes are synchronized between Active Directory and Red Hat Directory Server. Some attributes are mapped, where there are differences between Active Directory and Directory Server schemas, and some attributes are matched directly. The attributes (matched and mapped) which are synchronized are listed in Section 16.5.1, “User Attributes Synchronized between Directory Server and Active Directory” and Section 16.6.2, “Group Attributes Synchronized between Directory Server and Active Directory”.
By default, only those attributes are synchronized.
One type of attribute that is missing from that sync list is any POSIX-related attribute. On Linux systems, system users and groups are identified as POSIX entries, and LDAP POSIX attributes contain that required information. However, when Windows users are synchronized over, they have
ntGroupattributes automatically added which identify them as Windows accounts, but no POSIX attributes are synchronized over (even if they exist on the Active Directory entry) and no POSIX attributes are added on the Directory Server side.
The Posix Winsync API Plug-in synchronizes POSIX attributes between Active Directory and Directory Server entries.
All POSIX attributes (such as
homeDirectory) are synchronized between Active Directory and Directory Server entries. However, if a new POSIX entry or POSIX attributes are added to an existing entry in the Directory Server, only the POSIX attributes are synchronized over to the Active Directory corresponding entry. The POSIX object class (
posixAccountfor users and
posixGroupfor groups) is not added to the Active Directory entry.
16.9.1. Enabling POSIX Attribute Synchronization
The Posix Winsync API Plug-in is disabled by default and must be enabled for POSIX attributes to be synchronized from Active Directory user and group entries to the corresponding Directory Server entries.
To enable the Posix Winsync API plug-in:
- Enable the plug-in:
# dsconf -D "cn=Directory Manager" ldap://server.example.com plugin "cn=Posix Winsync API,cn=plugins,cn=config" enable
- Restart the instance:
# dsctl instance_name restartIf you enable the dynamic plug-in as described in Section 1.10.2, “Enabling Plug-ins Dynamically”, restarting the instance is not required.
16.9.2. Changing Posix Group Attribute Synchronization Settings
There are multiple plug-in attributes that can be set to control how the POSIX group attributes and group members are synchronized from the Active Directory entry to the corresponding Directory Server group and user entries. For details, see the corresponding section in the Red Hat Directory Server Configuration, Command, and File Reference.
The defaults can be used for most deployments, but the settings can be changed depending on the Active Directory environment. For example, to enable nested group mappings:
- Use the following command to enable the nested group mapping:
# dsconf -D "cn=Directory Manager" ldap://server.example.com plugin posix-winsync set --map-nested-grouping="true"
- Restart the Directory Server to load the new configuration.
# dsctl instance_name restart
16.9.3. Fixing Mismatched member and uniqueMember Attribute Values in posixGroup Entries
uniqueMemberattribute values in
posixGroupentries on Directory Server and Active Directory (AD) do not match, use the
dsconf plugin posix-winsync fixupcommand to fix the problem:
# dsconf -D "cn=Directory Manager" ldap://server.example.com plugin posix-winsync fixup DN
This command recreates
memberUidvalues on Directory Server and automatically modifies the
uniqueMemberattribute values to match the values defined in AD.
Optionally, pass the
-f filterparameter to the command to specify in which entries the command should fix
memberUidattributes. Without a filter, the command operates on all entries that contain the