I regard AD as broken by design in this regard. My question is, can this be fixed? What would be the right way to approach this problem?
Yes it's broken by design. As far as I know the way to work around it is to assign unique CN's (e.g. include middle initials, something like that). -- Fedora-directory-users mailing list Fedora-directory-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-directory-users