Schema Differences; Password Policies; Groups; Values For Street And Streetaddress - Red Hat DIRECTORY SERVER 8.0 - ADMINISTRATION Administration Manual

• The Summary tab allows the description of the agreement to be changed. This tab also shows the
sync peer host and port information and synchronized subtrees.
• The Connection tab allows the bind DN and bind credentials for the sync ID to be changed and
shows whether Windows users and groups are synchronized. It also shows whether synchronization
occurs over an SSL connection.

19.4. Schema Differences

Although Active Directory supports the same basic X.500 object classes as Directory Server, there are
a few incompatibilities of which administrators should be aware.

19.4.1. Password Policies

Both Active Directory and Directory Server can enforce password policies such as password minimum
length or maximum age. Windows Sync makes no attempt to ensure that the policies are consistent,
enforced, or synchronized. If password policy is not consistent in both Directory Server and Active
Directory, then password changes made on one system may fail when synched to the other system.
The default password syntax setting on Directory Server mimics the default password complexity rules
that Active Directory enforces.

19.4.2. Groups

Nested groups (where a group contains another group as a member) are supported and for WinSync
will be synchronized. However, Active Directory imposes certain constraints as to the composition
of nested groups. For example, a global group contain a domain local group as a member. Directory
Server has no concept of local and global groups, and, therefore, it is possible to create entries on the
Directory Server side that violate Active Directory's constraints when synchronized.

19.4.3. Values for street and streetAddress

Active Directory uses the attribute streetAddress for a user or group's postal address; this is
the way that Directory Server uses the street attribute. There are two important differences in the
way that Active Directory and Directory Server use the streetAddress and street attributes,
respectively:
• In Directory Server, streetAddress is an alias for street. Active Directory also has the
street attribute, but it is a separate attribute that can hold an independent value, not an alias for
streetAddress.
• Active Directory defines both streetAddress and street as single-valued attributes, while
Directory Server defines street as a multi-valued attribute, as specified in RFC 4519.
Because of the different ways that Directory Server and Active Directory handle streetAddress and
street attributes, there are two rules to follow when setting address attributes in Active Directory and
Directory Server:
• Windows Sync maps streetAddress in the Windows entry to street in Directory Server. To
avoid conflicts, the street attribute should not be used in Active Directory.
• Only one Directory Server street attribute value is synced to Active Directory. If the
streetAddress attribute is changed in Active Directory and the new value does not already exist
Schema Differences
463