Sure,
this is the relative parts.
PAM PASS THROUGH
dn: cn=PAM Pass Through Auth,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: extensibleObject
objectClass: pamConfig
cn: PAM Pass Through Auth
nsslapd-pluginPath: libpam-passthru-plugin
nsslapd-pluginInitfunc: pam_passthruauth_init
nsslapd-pluginType: betxnpreoperation
nsslapd-pluginEnabled: on
nsslapd-pluginloadglobal: true
nsslapd-plugin-depends-on-type: database
pamMissingSuffix: ALLOW
pamExcludeSuffix: cn=config
pamIncludeSuffix: ou=Internal Users,ou=people,dc=lab,dc=com
pamIDMapMethod: RDN ENTRY
pamIDAttr: uid
pamFallback: FALSE
pamSecure: FALSE
pamService: ldapserver
nsslapd-pluginId: pam_passthruauth
nsslapd-pluginVersion: 1.4.4.11
nsslapd-pluginVendor: 389 Project
nsslapd-pluginDescription: PAM pass through authentication plugin
modifiersName: cn=directory manager
modifyTimestamp: 20211126222824Z
dn: cn=Pass Through Authentication,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: extensibleObject
cn: Pass Through Authentication
nsslapd-pluginPath: libpassthru-plugin
nsslapd-pluginInitfunc: passthruauth_init
nsslapd-pluginType: preoperation
nsslapd-pluginEnabled: off
nsslapd-plugin-depends-on-type: database
nsslapd-pluginId: none
nsslapd-pluginVersion: none
nsslapd-pluginVendor: none
nsslapd-pluginDescription: none
modifiersName: cn=Directory Manager
modifyTimestamp: 20211126204904Z
WIN AGREEMENT
dn: cn=AD2D389,cn=replica,cn=dc\3Dlab\2Cdc\3Dcom,cn=mapping tree,cn=config
objectClass: top
objectClass: nsDSWindowsReplicationAgreement
cn: AD2D389
nsDS5ReplicaRoot: dc=lab,dc=com
description: AD2D389
nsDS5ReplicaHost: labdc1.lab.local
nsDS5ReplicaPort: 636
nsDS5ReplicaTransportInfo: LDAPS
nsDS5ReplicaBindDN: CN=cadroot,CN=Users,DC=lab,DC=local
nsds7WindowsReplicaSubtree: CN=D389Sync,DC=lab,DC=local
nsds7DirectoryReplicaSubtree: ou=testsync,dc=lab,dc=com
nsds7WindowsDomain: lab.local
nsds7NewWinUserSyncEnabled: on
oneWaySync: fromWindows
nsDS5ReplicaCredentials: {AES-TUhNR0NTcUdTSWIzRFFFRkRUQm1NRVVHQ1NxR1NJYjNEUUVG
RERBNEJDUmtOamt6TnpSbE9DMHlZelpsTXpFeA0KT0MwNU5UTXdZMk15WVMxalpUWTNNbVkyTkFBQ
0FRSUNBU0F3Q2dZSUtvWklodmNOQWdjd0hRWUpZSVpJQVdVRA0KQkFFcUJCQ01UWFd2dTBvVVA2L0
h5aE5xNlRhZA==}MzFOFTDpXeukpOmvxtf7fFlWjNB4LlKWM+Ldhzm/Ne4=
creatorsName: cn=Directory Manager
modifiersName: cn=Multimaster Replication Plugin,cn=plugins,cn=config
createTimestamp: 20211130085214Z
modifyTimestamp: 20211201203059Z
nsds5ReplicaEnabled: on
nsds7DirsyncCookie:: TVNEUwMAAABdO7uy8ebXAQAAAAAAAAAAKAAAAP3wAAAAAAAAAAAAAAAAA
AD98AAAAAAAAG0xgiTivNBHtESspvYhd58BAAAAAAAAAAEAAAAAAAAAbTGCJOK80Ee0RKym9iF3n/
3wAAAAAAAA
nsds50ruv: {replicageneration} 61a4ddd50000ffff0000
nsds50ruv: {replica 1 ldap://directory389.lab.local:389} 61a5e821000000010000
61a7da69000000010000
nsruvReplicaLastModified: {replica 1 ldap://directory389.lab.local:389} 61a7da
6a
EXAMPLE OF AD SYNCED USER(as you can see nsAccount is not present):
36 uid=test.user10,ou=testsync,dc=lab,dc=com
objectclass: top
objectclass: person
objectclass: organizationalperson
objectclass: inetOrgPerson
objectclass: ntUser
ntUserDeleteAccount: true
uid: test.user10
sn: User 10
givenName: Test
cn: Test User 10
ntUserCodePage: 0
ntUserAcctExpires: 9223372036854775807
ntUserDomainId: test.user10
ntUniqueId: 9658f59ce2a1d54cbeacb783c12a6de3
Once solved this issue, i think it would be better to sync AD user that belongs to specific AD Group in order to have a ore control over it instead of defining a specific OU.
I've seen a page wich reports the existence of "Support Filters": https://directory.fedoraproject.org/docs/389ds/design/winsync-rfe.html#2-support-filters-1
And it says:
new config parameters in windwows sync agreement:
winSyncWindowsFilter: additional_filter_on_AD
winSyncDirectoryFilter: additional_filter_on_DS
Example:
winSyncWindowsFilter: (|(cn=*user*)(cn=*group*))
winSyncDirectoryFilter: (|(uid=*user*)(cn=*group*))
Anyway it is not clear if my installed version support this feature
389-Directory/1.4.4.11 B2021.139.1122
Thanks for your support
Appreciate
_______________________________________________
389-users mailing list -- 389-users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to 389-users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/389-users@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
