Identity Sync for Windows problems and questions.

Question

the setup:
2 multimaster 5.2 LDAP servers sending updates to a slave replica 5.2 LDAP server.
The slave replica is the instance that has all of ISW software installed, ISW itself and the plugin.
1 2003 AD server is accepting password, cn, and other attribute changes from the slave LDAP replica.
the problem:
When changing a password, or any other attribute on the slave replica, all the changes get synced to AD tree.
When changing any attribute, except for the password on the master LDAP servers, all the changes get synced to LDAP replica and AD tree, except for the password entry in the AD tree. All the password policies have been disabled on all 4 servers.
An interesting detail - eventhough the LDAP replication updates the password entry from LDAP masters to LDAP slave replica, that same change doesn't propagade to the AD tree. Any other attribute changed on the master server, propagades all the way to the
AD tree. The only way to actually force the password change in AD tree, is to initiate the change from the LDAP slave.
Why is that and what can be done to fix it ?
Also, on the subject of replication. Since ISW configuration is stored in the main suffix tree, any attempt to reinitialize the slave replica ( aka ISW server ) erases the configuration completely, requiring a VERY long reinstall and reconfiguration effort.
Is there a way to preven the replica init from erasing ISW configuration ?
Any other suggestions or workarounds ??
thank you

Answer 1

Agree with you on most points. However no all the evnironments are continuously static. In ours, we need to add servers when demand grows
and with LDAP it does so continuosly. Different departments constantly coming up with more and more applications that take advantage for different data in the directory, some demanding authoritate control over various attributes, so I can see there's going to be need for 2 or more multimaster servers down the road. Hence the concern with replica initialization with IDSYNC present on a consumer.
The procedure for replication is defined clearly and the one step that troubles me ( if IDSYNC is present ) is replica initialization, since it completely erases all LDAP data from the replica. That's the problem.
If I restore the replica from the backup, restoring IDSYNC configuration with it, perhaps you're right,it may continue working, but at this point I see it as a design flaw and a major risk anyway.
I didn't see any options during the IDSYNC install to chose another directory
suffix to store IDSYNC configuration, which would've been a simple work around, since replica init erases everything under a specific parent suffix.
I'm just searcing for other ideas how this can be prevented, maybe
using some restrictive ACL to prevent IDSYNC config from being erased by
"Replication Manager" or something along those lines.