Red Hat Directory Server 8.0 Administrator's Guide

and shows whether Windows users and groups are synchronized. It also shows whether
synchronization occurs over an SSL connection.
4. Schema Differences
Although Active Directory supports the same basic X.500 object classes as Directory Server,
there are a few incompatibilities of which administrators should be aware.
4.1. Password Policies
Both Active Directory and Directory Server can enforce password policies such as password
minimum length or maximum age. Windows Sync makes no attempt to ensure that the policies
are consistent, enforced, or synchronized. If password policy is not consistent in both Directory
Server and Active Directory, then password changes made on one system may fail when
synched to the other system. The default password syntax setting on Directory Server mimics
the default password complexity rules that Active Directory enforces.
4.2. Groups
Nested groups (where a group contains another group as a member) are supported and for
WinSync will be synchronized. However, Active Directory imposes certain constraints as to the
composition of nested groups. For example, a global group contain a domain local group as a
member. Directory Server has no concept of local and global groups, and, therefore, it is
possible to create entries on the Directory Server side that violate Active Directory's constraints
when synchronized.
4.3. Values for street and streetAddress
Active Directory uses the attribute streetAddress for a user or group's postal address; this is
the way that Directory Server uses the street attribute. There are two important differences in
the way that Active Directory and Directory Server use the streetAddress and street
attributes, respectively:
• In Directory Server, streetAddress is an alias for street. Active Directory also has the
street attribute, but it is a separate attribute that can hold an independent value, not an alias
for streetAddress.
• Active Directory defines both streetAddress and street as single-valued attributes, while
Directory Server defines street as a multi-valued attribute, as specified in RFC 4519.
Because of the different ways that Directory Server and Active Directory handle streetAddress
and street attributes, there are two rules to follow when setting address attributes in Active
Directory and Directory Server:
• Windows Sync maps streetAddress in the Windows entry to street in Directory Server. To
Chapter 19. Synchronizing Red Hat Directory Server with Microsoft Active Directory
534