15.5. Managing Synchronization Agreements
15.5.1. Trusting the Active Directory and IdM CA Certificates
- On the Active Directory server, download the IdM server's CA certificate from
- Install the IdM CA certificate in the Active Directory certificate database. This can be done using the Microsoft Management Console or the certutil utility. For example:
certutil -installcert -v -config "ipaserver.example.com\Example Domain CA" c:\path\to\ca.crtFor more details, see the Active Directory documentation.
- Export the Active Directory CA certificate.
- In My Network Places, open the CA distribution point.
- Double-click the security certificate file (
.crtfile) to display the Certificate dialog box.
- On the Details tab, click Copy to File to start the Certificate Export Wizard.
- Click Next, and then select Base-64 encoded X.509 (.CER).
- Specify a suitable directory and file name for the exported file. Click Next to export the certificate, and then click Finish.
- Copy the Active Directory certificate over to the IdM server machine.
- Download the IdM server's CA certificate from
- Copy both the Active Directory CA certificate and the IdM CA certificate into the
- Update the hash symlinks for the certificates.
- Edit the
/etc/openldap/ldap.conffile, and add the information to point to and use the certificates in the
TLS_CACERTDIR /etc/openldap/cacerts/ TLS_REQCERT allow
15.5.2. Creating Synchronization Agreements
ipa-replica-manage connectcommand because it creates a connection to the Active Directory domain. The options to create the synchronization agreement are listed in Table 15.2, “Synchronization Agreement Options”.
- Make sure that the Active Directory and IdM servers trust each other's CA certificates, as in Section 15.5.1, “Trusting the Active Directory and IdM CA Certificates”.
- Remove any existing Kerberos credentials on the IdM server.
- Use the
ipa-replica-managecommand to create a Windows synchronization agreement. This requires the
--winsyncoption. If passwords will be synchronized as well as user accounts, then also use the
--passsyncoption and set a password to use for Password Sync.The
--bindpwdoptions give the username and password of the system account on the Active Directory server that IdM will use to connect to the Active Directory server.
$ ipa-replica-manage connect --winsync --binddn cn=administrator,cn=users,dc=example,dc=com --bindpw Windows-secret --passsync secretpwd --cacert /etc/openldap/cacerts/windows.cer adserver.example.com -v
- When prompted, enter the Directory Manager password.
- Optional. Configure Password Synchronization, as in Section 15.6.2, “Setting up Password Synchronization”.
Table 15.2. Synchronization Agreement Options
|--winsync||Identifies this as a synchronization agreement.|
|--binddn||Gives the full user DN of the synchronization identity. This is the user DN that the IdM LDAP server uses to bind to Active Directory. This user must exist in the Active Directory domain and must have replicator, read, search, and write permissions on the Active Directory subtree.|
|--bindpw||Gives the password for the sync user.|
|--passsync||Gives the password for the Windows user account which is involved in synchronization.|
|--cacert||Gives the full path and file name of the Active Directory CA certificate. This certificate is exported in Section 15.5.1, “Trusting the Active Directory and IdM CA Certificates”.|
|--win-subtree|| Gives the DN of the Windows subtree containing the users to synchronize. The default value is |
|AD_server_name||Gives the hostname of the Active Directory domain controller.|
15.5.3. Changing the Behavior for Syncing User Account Attributes
ldapmodifycommand to modify the LDAP server entry directly.
ipaWinSyncAcctDisableattribute. (Changing this means that if an account is disabled in Active Directory, it is still active in IdM and vice versa.)
[jsmith@ipaserver ~]$ ldapmodify -x -D "cn=directory manager" -w password dn: cn=ipa-winsync,cn=plugins,cn=config changetype: modify replace: ipaWinSyncAcctDisable ipaWinSyncAcctDisable: none modifying entry "cn=ipa-winsync,cn=plugins,cn=config"
Table 15.3. Synced Attribute Settings
|General User Account Parameters|
|ipaWinSyncNewEntryFilter||Sets the search filter to use to find the entry which contains the list of object classes to add to new user entries.|| The default is |
|ipaWinSyncNewUserOCAttr||Sets the attribute in the configuration entry which actually contains the list of object classes to add to new user entries.|| The default is |
|ipaWinSyncHomeDirAttr||Identifies which attribute in the entry contains the default location of the POSIX home directory.|| The default is |
|ipaWinSyncUserAttr|| Sets an additional attribute with a specific value to add to Active Directory users when they are synced over from the Active Directory domain. If the attribute is multi-valued, then it can be set multiple times, and the sync process adds all of the values to the entry.
This only sets the attribute value if the entry does not already have that attribute present. If the attribute is present, then the entry's value is used when the Active Directory entry is synced over.
|ipaWinSyncUserAttr: attributeName attributeValue|
|ipaWinSyncForceSync|| Sets whether to check existing IdM users which match an existing Active Directory user should be automatically edited so they can be synchronized. If an IdM user account has a ||true | false|
|User Account Lock Parameters|
|ipaWinSyncAcctDisable|| Sets which way to synchronize account lockout attributes. It is possible to control which account lockout settings are in effect. For example, || |
|ipaWinSyncInactivatedFilter||Sets the search filter to use to find the DN of the group used to hold inactivated (disabled) users. This does not need to be changed in most deployments.|| The default is |
|ipaWinSyncActivatedFilter||Sets the search filter to use to find the DN of the group used to hold active users. This does not need to be changed in most deployments.|| The default is |
|ipaWinSyncDefaultGroupAttr|| Sets the attribute in the new user account to reference to see what the default group for the user is. The group name in the entry is then used to find the || The default is |
|ipaWinSyncDefaultGroupFilter|| Sets the search filter to map the group name to the POSIX || The default is |
|ipaWinSyncRealmAttr||Sets the attribute which contains the realm name in the realm entry.|| The default is |
|ipaWinSyncRealmFilter||Sets the search filter to use to find the entry which contains the IdM realm name.|| The default is |
15.5.4. Changing the Synchronized Windows Subtree
cn=users,cn=accounts,$SUFFIX, and for Active Directory, the default is
--win-subtreeoption. After the agreement is created, the Active Directory subtree can be changed by using the
ldapmodifycommand to edit the
nsds7WindowsReplicaSubtreevalue in the sync agreement entry.
- Get the name of the sync agreement, using
ldapsearch. This search returns only the values for the
nsds7WindowsReplicaSubtreeattributes instead of the entire entry.
[jsmith@ipaserver ~]$ ldapsearch -xLLL -D "cn=directory manager" -w password -p 389 -h ipaserver.example.com -b cn=config objectclass=nsdswindowsreplicationagreement dn nsds7WindowsReplicaSubtree dn: cn=meToWindowsBox.example.com,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config nsds7WindowsReplicaSubtree: cn=users,dc=example,dc=com ... 8< ...
- Modify the sync agreement
[jsmith@ipaserver ~]$ ldapmodify -x -D "cn=directory manager" -W -p 389 -h ipaserver.example.com <<EOF dn: cn=meToWindowsBox.example.com,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config changetype: modify replace: nsds7WindowsReplicaSubtree nsds7WindowsReplicaSubtree: cn=alternateusers,dc=example,dc=com EOF modifying entry "cn=meToWindowsBox.example.com,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config"
15.5.5. Configuring Uni-Directional Sync
oneWaySyncparameter on the sync agreement. The possible values are
fromWindows(for Active Directory to Identity Management sync) and
toWindows(for Identity Management to Active Directory sync).
[jsmith@ipaserver ~]$ ldapmodify -x -D "cn=directory manager" -w password -p 389 -h ipaserver.example.com dn: cn=windows.example.com,cn=replica,cn=dc\3Dexample\2Cdc\3Dcom,cn=mapping tree,cn=config changetype: modify add: oneWaySync oneWaySync: fromWindows
15.5.6. Deleting Synchronization Agreements
ipa-replica-manage disconnectcommand and then the hostname of the Active Directory server.
- Delete the sync agreement.
# ipa-replica-manage disconnect adserver.example.com
- Remove the Active Directory CA certificate from the IdM server database:
# certutil -D -d /etc/dirsrv/slapd-EXAMPLE.COM/ -n "Imported CA"
15.5.7. Winsync Agreement Failures
One of the most common sync agreement failures is that the IdM server cannot connect to the Active Directory server:
"Update failed! Status: [81 - LDAP error: Can't contact LDAP server]
/etc/dirsrv/slapd-DOMAIN/directory) with the name Imported CA. This can be checked using
$ certutil -L -d /etc/dirsrv/slapd-DOMAIN/ Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI CA certificate CTu,u,Cu Imported CA CT,,C Server-Cert u,u,u Imported CA CT,,C
# certutil -d /etc/dirsrv/slapd-DOMAIN-NAME -D -n "Imported CA"
For some entries in the user database, there may be an informational error message that the password is not being reset because the entry already exists:
"Windows PassSync entry exists, not resetting password"