Zurück
-
Titel
How to synchronize group membership between Active Directory domains? -
Beschreibung
The information provided in this article can help you configure group membership synchronization between Active Directory or AD/LDS domains.
When attemping to synchronize the user's memberOf attribute you may experience the following error:
- Server is unwilling to process the request
-
Ursache
Active Directory does not allow direct modification of back-link attributes.
The memberOf attribute is a multi-valued attribute that contains groups of which the user is a direct member.
However, this attribute is not stored— it is a computed back-link attribute.
-
Lösung
- Configure mapping rules for groups and group members (users) between the source and target domains.
- Configure a direct synchronization rule for the member attribute between the source and target groups (see Slide 1).
For example, to provision group objects from an Active Directory domain to AD LDS (ADAM) specify a rule to synchronize the Active Directory member attribute with the AD LDS member attribute. - Quick Connect allows you to define to overwrite or append target group members using the Advanced link under the target Member rule (see Slide 1):
- Keep the reference (default): Appends group members. Does not remove any existing members from the target group (see Slide 2).
- Delete the reference: Overwrites the target group membership based on the source group membership and mapping rules. None-mapped target group members will be removed from target group.
-
Anhänge
-
Weitere Informationen
The member attribute of group objects and the memberOf attribute of user objects are linked. Member is the forward link attribute and memberOf is the back-link attribute. You cannot modify back-link attributes directly. The value of back-link attributes are not actually saved with the object, but instead refer to the forward link attribute. See this link for additional details: http://msdn.microsoft.com/en-us/library/ms677270(VS.85).aspx
