Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Goal: Have 389DirectoryServer (AKA Redhat/Centos/Fedora DS) pull account info from AD, allowing both AD accounts and 389-native accounts be authenticated through 389DS, but have the sync be one way, AD->389. We don't want accidental/malicious changes made on the 389 server to replicate back to AD. Ideally, we also wouldn't have to have use a DomainAdmin equivalent user.

All the existing documentation (most referencing makes it appear to be a two-way sync. Am I barking up the wrong tree?

*Edit:*I was going to not explain the higher-level goal in order to keep it focused, the actual endgame is for our students (to be provisioned in 389) and our employees (in AD) to be able to authenticate against CAS for our various systems, mostly web-based.( Don't ask why we're doing it that way, that's just what was presented to me to support. I have a feeling there's a simpler/more obvious/more commonly documented way, but I"m certainly not a cross-platform authentication/authorization expert. (Words like kerberos, RADIUS and/or PAM come to mind, but I don't rightly know exactly what all those actually are, the pros/cons, etc...but since we're already using RADIUS against our AD for Wireless 802.1x...)

share|improve this question
Can you post any details as to why you would want another ldap server if it's just going to mirror AD? I'm simply interested in the use case. – Jim B Jul 15 '10 at 20:14
probably because the AD schema is limited for what he wants to do; although since 2003r2 the ldap schema is much more unix friendly, I think somethings like netgroups are simply easier to implement in a unix ldap server; automounting with autofs is also another thing that comes to mind. – natxo asenjo Jul 15 '10 at 21:04
Please see edit above. – Scandalon Jul 15 '10 at 22:03
up vote 1 down vote accepted

Yes It is possible. Upgrade your 389 ds to Version 1.2.7 or higher

It is shipped with One way AD sync plugin which allow Windows Sync to go only from AD to DS, or only from DS to AD, instead of just the default bi-directional sync

Refer :-

share|improve this answer

We bit the bullet and put all of our (20K plus) student accounts into AD. It made some things one heck of a lot simpler. One-directory-to-rule-them-all is a lot easier to support for client services as well. We had to build one way syncs from our identity master (Banner) and build a completely separate password-change page for everyone's use.

It gave us a single LDAP source for all authentication. We also use CAS for SSO, and this certainly made things easier. Also, our WLAN authentication page only has a single directory to query, as well as all the myriad non-CAS web-apps we have knocking about on departmental web-servers.

share|improve this answer
These are mostly my questions as well, and what I have been lobbying for for awhile. Like I said, just dealing with what's been given to me. – Scandalon Aug 19 '10 at 21:23

What happens if you set up the sync agreement using an account that has read-only access to AD?

If that doesn't work (at best, it would probably be something of a hack), then can you use 389DS's database links or referrals functionality instead?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.