16.6. Synchronizing Groups
- Groups in the Active Directory domain are synchronized if it is configured in the sync agreement by selecting the Sync New Windows Groups option. All of the Windows groups are copied to the Directory Server when synchronization is initiated and then new groups are synchronized over as they are created.
- A Directory Server group account is synchronized to Active Directory through specific attributes that are present on the Directory Server entry. Any Directory Server entry must have the
ntGroupobject class and the
ntGroupCreateNewGroupattribute (even on an existing entry) signals Directory Server Windows Synchronization to write the entry over to the Active Directory server.New or modified groups that have the
ntGroupobject class are created and synchronized over to the Windows machine at the next regular update.
- Two attributes control whether Directory Server groups are created and deleted on Active Directory,
ntGroupCreateNewGroupis required to sync Directory Server groups over to Active Directory.
- ntUserDomainId contains the unique ID for the entry on the Active Directory domain. This is the only required attribute for the
- ntGroupType is the type of Windows group. Windows group types are global/security, domain local/security, builtin, universal/security, global/distribution, domain local/distribution, or universal/distribution. This is set automatically for Windows groups that are synchronized over, but this attribute must be set manually on Directory Server entries before they can be synchronized.
16.6.1. About Windows Group Types
-2147483646for global/security (the default)
-2147483644for domain local/security
4for domain local/distribution
16.6.2. Group Attributes Synchronized between Directory Server and Active Directory
Table 16.3. Group Entry Attribute Mapping between Directory Server and Active Directory
Table 16.4. Group Entry Attributes That Are the Same between Directory Server and Active Directory
16.6.3. Group Schema Differences between Red Hat Directory Server and Active Directory
16.6.4. Configuring Group Synchronization for Directory Server Groups
ntUserDomainIdattribute, to give the Windows ID for the entry.
ntGroupCreateNewGroupattribute, to signal to the synchronization plug-in to sync the Directory Server entry over to Active Directory.The
ntGroupDeleteGroupattribute is optional, but this sets whether to delete the entry automatically from the Active Directory domain if it is deleted in the Directory Server.
ntGroupTypeattribute. If this attribute is not specified, then the group is automatically added as a global security group (
# ldapmodify -D "cn=Directory Manager" -W -p 389 -h server.example.com -x dn: cn=Example Group,ou=Groups,dc=example,dc=com changetype: modify add: objectClass objectClass:ntGroup - add: ntUserDomainId ntUserDomainId: example-group - add: ntGroupCreateNewGroup ntGroupCreateNewGroup: true - add: ntGroupDeleteGroup ntGroupDeleteGroup: true - add: ntGroupType ntGroupType: 2
ntGroupobject class, are described in more detail in the Red Hat Directory Server 11 Configuration, Command, and File Reference.
16.6.5. Configuring Group Synchronization for Active Directory Groups
# dsconf -D "cn=Directory Manager" ldap://server.example.com repl-winsync-agmt set --sync-groups="on" --suffix="dc=example,dc=com" example-agreement