Cool Solution - Sync Users and Groups into a second Domain
From Univention Wiki
This article describes, how to import Users and Groups from one domain into a second through a synchronization system. The implementation keeps the target system in sync with the source system (One-Way Synchronization).
For this setup to work, the external target system can be unable to reach the internal source system. However, the internal source system must be able to gain SSH access to the target. This solution is especially helpful to keep a server in the DMZ up-to-date with changes to users and groups in an internal, inaccessible UCS environment. Both systems are allowed to have different LDAP bases.
First, you have to install two packets. There is one package each for the source and target systems.
Install the destination package on the target UCS system:
apt install univention-user-group-sync-dest
This package will create a local service user called 'ucs-sync', which the leading UCS system will transfer it's data through. A password has to be set for this user during the installation, as the leading system needs to create a SSH connection during it's package installation for one time. Afterwards, the password isn't needed anymore. The leading UCS system will authorize itself through an identity key.
Now, install the source package on the leading UCS system. The hostname or IP address of the target UCS system has to be entered during installation. Further, the set password of user 'ucs-sync' on the target UCS system has to be entered once to transfer an SSH identity file for later authentications
apt install univention-user-group-sync-source
After successful installation, the
univention-directory-listener service will automatically create files for all user and group objects below the LDAP base. Afterwards, every object change will be tracked.
These files are automatically transferred by a cron job of the leading UCS system and imported again through another cron job of the target UCS system. Both cron jobs are executed every 5 minutes, which can be changed below.
Filter the LDAP objects to be synchronized
By default, all user and group objects below the LDAP base will be synchronized. It is possible to limit the range to be synchronized in an LDAP filter set through the UCR attribute
ldap/sync/filter. Note: It is important, that only user and group objects are listed by the set filter. Other objects aren't supported at this time.
(|(&(objectClass=posixGroup)(objectClass=univentionGroup))(objectClass=posixAccount)) will be used, if none is set.
Adjust the synchronization times
The synchronization processes for data transfer and data import are executed every five minutes on both systems. This means, that it can - in theory - take almost up to 10 minutes for an object to be existent on the destination system after it's initial creation.
The process timings can be adjusted through UCR attributes. Attribute
cron/ldap-sync-src/time is available on the source UCS system to adjust the data transfer process.
The data import process timing can be adjusted through UCR attribute