Convert Edir to AD Driver to Bi Directional

With passwords synced there's no reason to have 2 home directories anyway. You can easily populate the AD homedir with a UNC path and AD clients will mount the home dir via Samba on Netware. Occasionally you'll have a Windoze box moan at you that it's not a valid UNC path when modifying users in AD, but it's perfectly valid; it's not a path to a box in the AD, certainly not invalid.

Critical thing to remember is that you need to decide which directory is the authority on password policy. In your case it sounds like eDirectory. Disable ALL password policies in AD in regard to expiry time, length etc... Otherwise you can potentially end up with a situation where a user sets a password in eDir, it syncs to AD which decides it doesn't comply with it's policy and you get an event triggered which loops back to eDir and makes a mess of that too, leaving the user unable to login. This happened to me when I did my first bi-directional eDir/AD driver about 5 years ago and the AD administrator hadn't done what he promised. Resulted in some frantic LDIF butchery and an experience I don't wish to repeat.

Essentially you just need to modify the driver filters to allow OU, group and CN (and the desired attributes) to flow back to eDirectory, although I'd high recommend testing it in a dev environment first to make sure all goes smoothly.

Alextoft,

Thanks for a reply other then pay me to do it.  Here is the deal we are moving away from Edirectory and are going to start using AD as our Authoritive System. We want to create users in AD and home directories on MS servers but not have that field go to EDir because well that would cause some errors.  

What I am really curious about is how does AD notify EDir about a password change?  Is it the same way that EDir notifies AD?  DO i just enable notify on that channel.  

Also when stuff starts syncing back to EDir from AD will it be only stuff from the NOVELL OU and under since right now I have all EDIr syncing to a OU named novell?

I didn't mean to send you a reply offering a consulting only option for payment.  IDM is a big deal and done wrong kills directories...I've seen it happen to directories with thousands of users and it is not pretty.

Regarding passwords, you must have Universal Password setup which creates what IDM considers the "distribution password".  You cannot sync existing passwords to either directory...a password change must occur *after* the password sync driver is in place.

IDM allows you to specify which attribute is authoritative from which directory.  If you don't want an attribute syncing from AD back to eDirectory, don't let it.