16.9. Synchronizing POSIX Attributes for Users and Groups

A subset of all possible user and attributes are synchronized between Active Directory and Red Hat Directory Server. Some attributes are mapped, where there are differences between Active Directory and Directory Server schemas, and some attributes are matched directly. The attributes (matched and mapped) which are synchronized are listed in Section 16.5.1, “User Attributes Synchronized between Directory Server and Active Directory” and Section 16.6.2, “Group Attributes Synchronized between Directory Server and Active Directory”.
By default, only those attributes are synchronized.
One type of attribute that is missing from that sync list is any POSIX-related attribute. On Linux systems, system users and groups are identified as POSIX entries, and LDAP POSIX attributes contain that required information. However, when Windows users are synchronized over, they have ntUser and ntGroup attributes automatically added which identify them as Windows accounts, but no POSIX attributes are synchronized over (even if they exist on the Active Directory entry) and no POSIX attributes are added on the Directory Server side.
The Posix Winsync API Plug-in synchronizes POSIX attributes between Active Directory and Directory Server entries.

Note

All POSIX attributes (such as uidNumber, gidNumber, and homeDirectory) are synchronized between Active Directory and Directory Server entries. However, if a new POSIX entry or POSIX attributes are added to an existing entry in the Directory Server, only the POSIX attributes are synchronized over to the Active Directory corresponding entry. The POSIX object class (posixAccount for users and posixGroup for groups) is not added to the Active Directory entry.

16.9.1. Enabling POSIX Attribute Synchronization

The Posix Winsync API Plug-in is disabled by default and must be enabled for POSIX attributes to be synchronized from Active Directory user and group entries to the corresponding Directory Server entries.
To enable the Posix Winsync API plug-in:
  1. Enable the plug-in: 
    # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin "cn=Posix Winsync API,cn=plugins,cn=config" enable
  2. Restart the instance: 
    # dsctl instance_name restart

16.9.2. Changing Posix Group Attribute Synchronization Settings

There are multiple plug-in attributes that can be set to control how the POSIX group attributes and group members are synchronized from the Active Directory entry to the corresponding Directory Server group and user entries. For details, see the corresponding section in the Red Hat Directory Server Configuration, Command, and File Reference.
The defaults can be used for most deployments, but the settings can be changed depending on the Active Directory environment. For example, to enable nested group mappings:
  1. Use the following command to enable the nested group mapping: 
    # dsconf -D "cn=Directory Manager" ldap://server.example.com plugin posix-winsync set --map-nested-grouping="true"
  2. Restart the Directory Server to load the new configuration. 
    # dsctl instance_name restart

16.9.3. Fixing Mismatched member and uniqueMember Attribute Values in posixGroup Entries

If the member and uniqueMember attribute values in posixGroup entries on Directory Server and Active Directory (AD) do not match, use the dsconf plugin posix-winsync fixup command to fix the problem: 
# dsconf -D "cn=Directory Manager" ldap://server.example.com plugin posix-winsync fixup DN
This command recreates memberUid values on Directory Server and automatically modifies the member and uniqueMember attribute values to match the values defined in AD.
Optionally, pass the -f filter parameter to the command to specify in which entries the command should fix memberUid attributes. Without a filter, the command operates on all entries that contain the inetuser, inetadmin, and nsmemberof object class.