389-ds-base/ldap/servers/plugins/posix-winsync

This is a winsync plugin for the 389 directory server. http://port389.org

The Posix Winsync Plugin syncs Posix attributes between 389 DS and MS
AD for users and groups, if the attributes are available in one of the
tow worlds. For syncing from AD to DS it will add the objectclass
posixAccount and ShadowAccount or posixGroup for the ldap entry.
For sync a user or group from DS to AD AD needs a nisdomain name, the
nisdomin name I have stored in the upper container of the users and
groups, e.g.:
dn: dc=example,dc=dom
nisDomain: example
objectClass: top
objectClass: domain
objectClass: nisdomainobject
dc: example
It can be stored in any container above the user and group container
and below the replicated DS subtree.
The MSFU35 and the RFC2307 schema of AD is supported, but must
configured in the plugin. User lock/unlock will sync and lock the user
on DS with nsmanageddisabledrole. The code is borrowed from the
freeIPA project.
It is also possible to generate memberUid Attributes in Posix Groups
corresponding the group members, if the members are Posix Users.
After syncing from AD with a change in group membership, it will
schedule a 'Member of Plugin' task, so that users get the memberOf
attributes. For that the posix user get the objectclass inetUser

Configuration

The configuration entry DN is cn=Posix Winsync API,cn=plugins,cn=config

there are 4 Config attributes:

posixWinsyncMsSFUSchema -- set this true for the old MSFU schema on W2k3 AD's
default: false

posixWinsyncMapMemberUID -- set this false, if you don't want generate memberUid attributs in posix Groups
default: true

posixWinsyncCreateMemberOfTask -- create a task for the member of plugin to
generate the memberOf attributes in a user, if a group membership in
any user is changed while syncing. The postop-/preop plugins will not
called through winsync, thats why create a task.
default: false

posixWinsyncLowerCaseUID: some customers use uppercase letters in samAccountName
which is mapped to uid. uid should be case insensitve and works on
Unix/Linux for users, but makes problems with supplementary groups (a least on Solaris)
so you can set this to true, so that memberUid attributes will convert to lowercase.
default: false