Red Hat DIRECTORY SERVER 8.1 - DEPLOYMENT Deployment Manual page 114

Chapter 7. Designing Synchronization
Which entries are synchronized is set in the synchronization agreement. User entries are
synchronized separately from group entries. Additionally, deleting entries is configured separately;
deletions have to be specifically synchronized.
In the Directory Server, only entries that contain the ntGroup or ntUser object classes and required
attributes are synchronized; determine what existing and future entries should be synchronized with
the Windows server.
After determining what entries should be present in the directory, determine what attributes of these
objects need to be maintained in the directory. Only a subset of the possible attributes for Directory
Server or for Active Directory are synchronized. Additionally, this subset of attributes can be limited
even more by excluding certain attributes through the sync agreement (fractional synchronization).
Plan both the entries and the data contained in those entries according to the available
synchronization attributes. The synchronized attributes and the differences between Directory Server
Section 7.3, "Schema Elements Synchronized Between
and Active Directory schema are described in
Active Directory and Directory Server".
7.2.8. Synchronizing Passwords and Installing Password Services
While the DirSync plug-in is installed with the Directory Server and enabled by default, an additional
Windows service, Password Sync, must be installed on the Windows machine to synchronize
passwords. This service is required to transfer any password changes made on the Windows server
over to the Directory Server.
Unless the Password Sync service is installed, password synchronization (synchronizing the
userPassword attribute) is not enabled. What this means is that even if Directory Server user entries
are synchronized over to the Windows server, the user entries are not active on the Windows domain
(meaning, among other things, those synced users cannot log into the domain, since they do not have
a password).
7.2.9. Defining an Update Strategy
Existing Directory Server entries that are modified to contain the necessary synchronization attributes
are not synchronized until the next total update. Modifications to Windows entries and Directory Server
entries that have already been synchronized are carried at the next incremental update. As a part of
this strategy, try to master data in a single place, limiting the applications that can change the data,
and schedule necessary total updates (these updates do not overwrite or delete existing information;
they add new entries and send modifications).
By default, the Windows and Directory Server instances are kept constantly in sync and have changes
published every five minutes. This schedule can be altered by manually setting the sync agreement
attributes to change the update interval (winSyncInterval) or by setting a different update schedule
(nsDS5ReplicaUpdateSchedule).
7.2.10. Editing the Sync Agreement
The basic sync agreement configured through the Directory Server Console sets very simple
information about synchronization, like the host and port information, synchronized subtrees, and
connection types.
However, many configurations available to multi-master replication, like fractional replication and sync
schedules, are available to Windows-Directory Server synchronization. These settings must simply be
added to the sync agreement manually.
104