HP-UX Directory Server 8.1 deployment guide

Plan both the entries and the data contained in those entries according to the available
synchronization attributes. The synchronized attributes and the differences between Directory
Server and Active Directory schema are described in “Schema elements sycnhronized between
Active Directory and Directory Server”.
7.2.8 Synchronizing passwords and installing password services
While the DirSync plug-in is installed with the Directory Server and enabled by default, an
additional Windows service, Password Sync, must be installed on the Windows machine to
synchronize passwords. This service is required to transfer any password changes made on the
Windows server over to the Directory Server.
Unless the Password Sync service is installed, password synchronization (synchronizing the
userPassword attribute) is not enabled. What this means is that even if Directory Server user
entries are synchronized over to the Windows server, the user entries are not active on the
Windows domain (meaning, among other things, those synced users cannot log into the domain,
since they do not have a password).
7.2.9 Defining an update strategy
Existing Directory Server entries that are modified to contain the necessary synchronization
attributes are not synchronized until the next total update. Modifications to Windows entries
and Directory Server entries that have already been synchronized are carried at the next
incremental update. As a part of this strategy, try to master data in a single place, limiting the
applications that can change the data, and schedule necessary total updates (these updates do
not overwrite or delete existing information; they add new entries and send modifications).
By default, the Windows and Directory Server instances are kept constantly in sync and have
changes published every five minutes. This schedule can be altered by manually setting the sync
agreement attributes to change the update interval (winSyncInterval) or by setting a different
update schedule (nsDS5ReplicaUpdateSchedule).
7.2.10 Editing the sync agreement
The basic sync agreement configured through the Directory Server Console sets very simple
information about synchronization, like the host and port information, synchronized subtrees,
and connection types.
However, many configurations available to multi-master replication, like fractional replication
and sync schedules, are available to Windows-Directory Server synchronization. These settings
must simply be added to the sync agreement manually.
Changing the default sync agreement is described in the Administrator's Guide, and the available
sync agreement attributes are listed in the Configuration, Command, and File Reference.
7.3 Schema elements sycnhronized between Active Directory and Directory
Server
All synchronized entries in the Directory Server, whether they originated in the Directory Server
or in the Windows server, have the following special synchronization attributes:
• ntUniqueId contains the value of the objectGUID attribute for the corresponding Windows
entry. This attribute is set by the synchronization process and should not be set or modified
manually.
• ntUserDeleteAccount is set automatically when a Windows entry is synchronized but
must be set manually for Directory Server entries. If ntUserDeleteAccount has the value
true, the corresponding Windows entry is deleted when the Directory Server entry is
deleted.
98 Designing synchronization