Bug 41680 – AD Connector: Make global_ignore_subtree configurable via UCR

Bug 41680 - AD Connector: Make global_ignore_subtree configurable via UCR


Summary:	AD Connector: Make global_ignore_subtree configurable via UCR

Status:	CLOSED FIXED

Product:	UCS
Classification:	Unclassified
Component:	AD Connector
Version:	UCS 4.1
Hardware:	Other Linux

Importance:	P5 enhancement (vote)
Target Milestone:	UCS 4.1-3-errata
Assigned To:	Stefan Gohmann
QA Contact:	Felix Botner

URL:
Keywords:

Depends on:
Blocks:	47008
	Show dependency tree / graph

Reported:	2016-06-28 13:02 CEST by Michael Grandjean
Modified:	2018-05-15 10:30 CEST (History)
CC List:	1 user (show)

See Also:	43237
What kind of report is it?:	Feature Request
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):	External feedback, Forked for project
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Michael Grandjean

2016-06-28 13:02:31 CEST

The AD Connector mapping file uses 'global_ignore_subtree' to ignore a bunch of LDAP subtrees so they do NOT get synchronized. Unfortunately this is a hard coded list and not configurable. In some scenarios this ignore list must be extended so we should make this possible, just as other objects can be ignored via UCR, too (groups, users, containers ...)

Comment 1 Stefan Gohmann

2016-09-13 13:32:45 CEST

* Make the global_ignore_subtree configuration option configurable
  via the UCR variable connector/ad/mapping/ignoresubtree/* (Bug #41680)

4.1-3: r72540
4.2: r72541
YAML: r72542

Comment 2 Felix Botner

2016-09-14 10:59:09 CEST

OK - connector/ad/mapping/ignoresubtree

UCS 4.1-3 with ad connector + windows server 2012

(1)
# container ignore with two users ignore1 and ignore2
@ucs-> univention-ldapsearch -LLL -b "cn=ignore,$(ucr get ldap/base)" dn
dn: cn=ignore,dc=four,dc=test
dn: uid=ignore1,cn=ignore,dc=four,dc=test
dn: uid=ignore2,cn=ignore,dc=four,dc=test

(2)
# disabled sync of ignore container
@ucs-> ucr set connector/ad/mapping/ignoresubtree/ignore="cn=ignore,dc=four,dc=test"

(3)
configured/started ad connector (bidirectional)

(4)
# container and users NOT synced to ad
@ucs-> nivention-adsearch 'cn=ignore1'
@ucs-> nivention-adsearch 'cn=ignore2'
@ucs-> nivention-adsearch 'cn=ignore'
@ucs-> nivention-adsearch 'cn=ignore*'

OK - merged to 4.2-0
OK - yaml

Comment 3 Janek Walkenhorst

2016-09-14 15:38:58 CEST

<http://errata.software-univention.de/ucs/4.1/267.html>