Maybe if you create a script that modifies both directories at the same time can help. For example, on Windows you can run: dsmod user <user's DN> -disabled yes You can modify the user attributes in FDS with ldapmodify. There is also ldapmodify.exe than can run on Windows. http://www.novell.com/coolsolutions/feature/5993.html Para <fedora-directory-users at redhat.c om> "Aaron Oas" cc <AOas at redbrickhealth.com > Asunto Enviado por: RHDS fedora-directory-users-b and winsync... how to sync ounces at redhat.com disablement of users Clasificaci?n 13/02/2008 07:28 p.m. Uso Interno Por favor, responda a "General discussion list for the Fedora Directory server project." <fedora-directory-users@ redhat.com> I have a Win2003 AD server and a RHDS 8.0 server, with a windows sync agreement between them. The SSL, win sync agreement and the password sync are all working fine. Our intent is to do core user management from one place: AD, and then have various apps and linux hosts using the RHDS server as needed. One of the key user management functions is disabling an account when the person leaves. We don't want to delete accounts, because you lose some ability to trace ownership after the fact etc. Using the "disable account" option in AD does not carry over, since AD just stores that flag in a bitmask type of attribute (userAccountControl), and winsync does not map that attribute (not surprisingly since the attribute is ugly). Expiring the account in AD also doesn't work. It seems to map improperly in the winsync mapping: the time value that ends up on the RHDS side is translated wildy inaccurately in the RHDS console (hundreds of years off). I am looking at writing a perl daemon to watch AD, pull the "user disabled" value from the userAccountControl attributes of all the users in AD, then map that to the nsaccountlock attribute in RHDS. This includes resulting woes of: do I try to track changes and see which side made the change first (i.e. AD -> DS versus DS -> AD)? Or do I just take the "easy" way out and assume AD is right, etc. etc. Is there any better way to sync the disabling of accounts between AD and RHDS/FDS? Aaron Oas -- Fedora-directory-users mailing list Fedora-directory-users at redhat.com https://www.redhat.com/mailman/listinfo/fedora-directory-users ======================================================================================== AVISO LEGAL: Esta informaci?n es privada y confidencial y est? dirigida ?nicamente a su destinatario. Si usted no es el destinatario original de este mensaje y por este medio pudo acceder a dicha informaci?n por favor elimine el mensaje. La distribuci?n o copia de este mensaje est? estrictamente prohibida. Esta comunicaci?n es s?lo para prop?sitos de informaci?n y no debe ser considerada como propuesta, aceptaci?n ni como una declaraci?n de voluntad oficial de NUCLEO S.A. La transmisi?n de e-mails no garantiza que el correo electr?nico sea seguro o libre de error. Por consiguiente, no manifestamos que esta informaci?n sea completa o precisa. Toda informaci?n est? sujeta a alterarse sin previo aviso. This information is private and confidential and intended for the recipient only. If you are not the intended recipient of this message you are hereby notified that any review, dissemination, distribution or copying of this message is strictly prohibited. This communication is for information purposes only and shall not be regarded neither as a proposal, acceptance nor as a statement of will or official statement from NUCLEO S.A. . Email transmission cannot be guaranteed to be secure or error-free. Therefore, we do not represent that this information is complete or accurate and it should not be relied upon as such. All information is subject to change without notice.
