Author Topic: AD sync only transfers some users  (Read 4981 times)

pixeldrift

  • Zen Apprentice
  • *
  • Posts: 6
  • Karma: +0/-0
    • View Profile
AD sync only transfers some users
« on: February 03, 2010, 09:58:56 pm »
I had this issue under 1.3 and am now getting the same results after a completely clean fresh install of the 1.4 beta. I have a Windows 2003 Active Directory tree with about 50 users. Setting up the eBox as a slave to AD worked fine and everything seems to be connecting correctly... except only 14 users show up on the eBox, including the "eboxadsync". There seems to be no rhyme or reason for why those particular users are working and not the others. They are from different OU's, some are administrators and some not, some have logged in recently and others not, etc. It seems completely random.

Any suggestions on why this would be happening, or more importantly on how to get the rest of them to show up?
« Last Edit: February 04, 2010, 09:51:27 pm by pixeldrift »

J. A. Calvo

  • Zentyal Staff
  • Zen Hero
  • *****
  • Posts: 1986
  • Karma: +67/-3
    • View Profile
    • http://blogs.zentyal.org/jacalvo
Re: AD sync only transfers some users
« Reply #1 on: February 04, 2010, 01:17:50 am »
You can look at /var/log/ebox/ebox.log to see if you are getting any error during the sync process...
Zentyal Server Lead Developer

pixeldrift

  • Zen Apprentice
  • *
  • Posts: 6
  • Karma: +0/-0
    • View Profile
Re: AD sync only transfers some users
« Reply #2 on: February 04, 2010, 10:18:59 pm »
Yeah, I checked the logs and get a list of existing users that it's updating, followed by a message about groups, like so

Quote
...
ebox-ad-sync:66 main:: - [ad-sync] Updating existing user jkirk

ebox-ad-sync:78 main:: - [ad-sync] Adding new group Windows Authorization Access Group

UsersAndGroups.pm:1362 EBox::UsersAndGroups::addGroup - Groupname must not be longer than 32 characters

Would that have anything to do with it?

J. A. Calvo

  • Zentyal Staff
  • Zen Hero
  • *****
  • Posts: 1986
  • Karma: +67/-3
    • View Profile
    • http://blogs.zentyal.org/jacalvo
Re: AD sync only transfers some users
« Reply #3 on: February 05, 2010, 01:55:52 am »
Probably it's related. Is that a group created by you or a windows default one? If it is the second, do you know if it has a special attribute in LDAP in order to filter it during the sync?
Zentyal Server Lead Developer

technema

  • Zen Apprentice
  • *
  • Posts: 19
  • Karma: +0/-0
    • View Profile
Re: AD sync only transfers some users
« Reply #4 on: February 05, 2010, 10:19:21 am »
Same issue here with Windows server 2008
I've just change the value in UsersAndGroups.pm.
It's not clean but it seems to work

However, if a user belongs to a group in my active directory, this user isn't listed in this group on ebox ...

pixeldrift

  • Zen Apprentice
  • *
  • Posts: 6
  • Karma: +0/-0
    • View Profile
Re: AD sync only transfers some users
« Reply #5 on: February 05, 2010, 09:30:49 pm »
Is that a group created by you or a windows default one? If it is the second, do you know if it has a special attribute in LDAP in order to filter it during the sync?

No, I have no idea where that group came from. Perhaps I should just try deleting it? The documentation said that you would have to reset user passwords before they'll show up on eBox? I did this on a test account, and it did not appear. Whereas some of the accounts that are syncing haven't been touched in quite a while. The odd thing is that it's not just the first few users, it's a random sampling that seem to work.

I'm very new to AD myself, so maybe I'm not the best person to be testing this. But on the other hand, if you need to be a Windows Server expert to figure it out, then it still needs work.! :)

Basically I have OUs for students, staff, and the administration. I'm trying to get eBox pull in the accounts, and apply policies (captive portal, content filtering, etc) based on the user's OU. Is that unrealistic?

technema

  • Zen Apprentice
  • *
  • Posts: 19
  • Karma: +0/-0
    • View Profile
Re: AD sync only transfers some users
« Reply #6 on: February 10, 2010, 02:51:00 pm »
Same issue here with Windows server 2008
I've just change the value in UsersAndGroups.pm.
It's not clean but it seems to work

However, if a user belongs to a group in my active directory, this user isn't listed in this group on ebox ...

UP, i have always this issue

technema

  • Zen Apprentice
  • *
  • Posts: 19
  • Karma: +0/-0
    • View Profile
Re: AD sync only transfers some users
« Reply #7 on: February 11, 2010, 12:43:30 pm »
Is someone here ? The ad-sync doesn't work at all !!!!

Please help

Thx

Saturn2888

  • Zen Hero
  • *****
  • Posts: 707
  • Karma: +1/-0
    • View Profile
Re: AD sync only transfers some users
« Reply #8 on: February 11, 2010, 01:05:52 pm »
It works for me, but I have not tried it in Windows servers. What version of eBox? I believe 1.3 does not work correctly for Windows 7 meaning it might not work in Server 2008 R2.

technema

  • Zen Apprentice
  • *
  • Posts: 19
  • Karma: +0/-0
    • View Profile
Re: AD sync only transfers some users
« Reply #9 on: February 11, 2010, 02:11:50 pm »
It works for me, but I have not tried it in Windows servers. What version of eBox? I believe 1.3 does not work correctly for Windows 7 meaning it might not work in Server 2008 R2.

I have the last release of ebox (1.4.1). Users sync correctly, but not the groups.
The passwd doesn't sync at all.

See some errors in ebox.log :
Quote
UsersAndGroups.pm:1365 EBox::UsersAndGroups::addGroup - Groupname must not be longer than 32 characters
ebox-ad-sync:296 main::getPrincipalName - [ad-sync] can't get userPrincipalName for ...
UsersAndGroups.pm:1377 EBox::UsersAndGroups::addGroup - Invalid value for group name: ...

Saturn2888

  • Zen Hero
  • *****
  • Posts: 707
  • Karma: +1/-0
    • View Profile
Re: AD sync only transfers some users
« Reply #10 on: February 11, 2010, 02:16:42 pm »
Do you have a group name over 32 characters in length?

technema

  • Zen Apprentice
  • *
  • Posts: 19
  • Karma: +0/-0
    • View Profile
Re: AD sync only transfers some users
« Reply #11 on: February 11, 2010, 02:20:21 pm »
Do you have a group name over 32 characters in length?

Yes, but it's a default group of Windows Server ...
To avoid this issue, i have just change the MAXGROUPLENGTH variable in /usr/share/perl5/EBox/UsersAndGroups.pm

Saturn2888

  • Zen Hero
  • *****
  • Posts: 707
  • Karma: +1/-0
    • View Profile
Re: AD sync only transfers some users
« Reply #12 on: February 11, 2010, 02:27:19 pm »
Why /is/ it 32 characters? That would explain the issue though.

technema

  • Zen Apprentice
  • *
  • Posts: 19
  • Karma: +0/-0
    • View Profile
Re: AD sync only transfers some users
« Reply #13 on: February 11, 2010, 02:31:13 pm »
Why /is/ it 32 characters? That would explain the issue though.

So ebox doesn't work with Windows server to sync users ...
If a developer could explain why it's 32 characters max ?

Saturn2888

  • Zen Hero
  • *****
  • Posts: 707
  • Karma: +1/-0
    • View Profile
Re: AD sync only transfers some users
« Reply #14 on: February 11, 2010, 02:34:14 pm »
It does work. You have a group over 32 characters and maybe that's just some arbitrary limit or something, for compatibility reasons, with older versions of Windows Server. Maybe it's to be compliant with older Linux Samba versions. The main thing is, if Windows Server has no 32-character limitation, then there should be a checkbox somewhere to enable or disable the 32-character limit.