Синхронизация ad <-> openldap ч.2

Оказывается есть такая чудная софтина lsc (lsc-project.org), которая умеет синхронизировать базы пользователей в разных ldap'ах, sql'ях, текстовых файлах и ad. Главное - правильно написать конфиг. Вот что у меня получилось для синхронизации юзеров и групп openldap и AD:

dst.java.naming.provider.url = ldaps://dc.lan.int/dc=ad,dc=lan,dc.int

dst.java.naming.security.authentication = simple

dst.java.naming.security.principal = cn=Administrator,cn=users,dc=ad,dc=lan,dc.int/

dst.java.naming.security.credentials = xxxxxxxx

dst.java.naming.referral = ignore

dst.java.naming.ldap.derefAliases = never

dst.java.naming.factory.initial = com.sun.jndi.ldap.LdapCtxFactory

dst.java.naming.ldap.version = 3

src.java.naming.provider.url = ldap://ldap.lan.int/dc=lan,dc=int

src.java.naming.security.authentication = none

src.java.naming.security.principal = cn=Directory Manager,dc=lsc-project,dc=org

src.java.naming.security.credentials = secret

src.java.naming.referral = ignore

src.java.naming.ldap.derefAliases = never

src.java.naming.factory.initial = com.sun.jndi.ldap.LdapCtxFactory

src.java.naming.ldap.version = 3

lsc.tasks = user, group

lsc.tasks.user.srcService = org.lsc.jndi.SimpleJndiSrcService

lsc.tasks.user.srcService.baseDn = ou=people

lsc.tasks.user.srcService.filterAll = (&(uid=*)(objectClass=inetOrgPerson))

lsc.tasks.user.srcService.pivotAttrs = uid

lsc.tasks.user.srcService.filterId = (&(objectClass=inetOrgPerson)(uid={uid}))

lsc.tasks.user.srcService.attrs = givenName cn sn uid

lsc.tasks.user.dstService = org.lsc.jndi.SimpleJndiDstService

lsc.tasks.user.dstService.baseDn = cn=users

lsc.tasks.user.dstService.filterAll = (&(sAMAccountName=*)(objectClass=user)(!(sAMAccountName=Administrator))(!(sAMAccountName=Guest))(!(sAMAccountName=krbtgt)))

lsc.tasks.user.dstService.pivotAttrs = uid

lsc.tasks.user.dstService.filterId = (&(objectClass=user)(sAMAccountName={uid}))

lsc.tasks.user.dstService.attrs = cn sn objectClass sAMAccountName displayName userPrincipalName mail userAccountControl givenName uid pwdLastset unicodePwd

lsc.tasks.user.bean = org.lsc.beans.SimpleBean

lsc.tasks.user.dn = "cn=" + srcBean.getAttributeValueById("cn") + ",cn=users"

lsc.syncoptions.user = org.lsc.beans.syncoptions.PropertiesBasedSyncOptions

lsc.syncoptions.user.default.action = F

lsc.syncoptions.user.objectClass.action = F

lsc.syncoptions.user.objectClass.force_value = "top";"user";"person";"organizationalPerson"

lsc.syncoptions.user.sAMAccountName.create_value = srcBean.getAttributeValueById("uid")

lsc.syncoptions.user.userPrincipalName.force_value = srcBean.getAttributeValueById("uid") + "@ad.lan.int"

lsc.syncoptions.user.userAccountControl.create_value = AD.userAccountControlSet( "0", [AD.UAC_SET_NORMAL_ACCOUNT])

lsc.syncoptions.user.pwdLastset.create_value = "0"

lsc.syncoptions.user.unicodePwd.create_value = AD.getUnicodePwd("changeit")

lsc.tasks.group.bean = org.lsc.beans.SimpleBean

lsc.tasks.group.dn = "cn=" + srcBean.getAttributeValueById("cn") + ",ou=groups"

lsc.tasks.group.srcService = org.lsc.jndi.SimpleJndiSrcService

lsc.tasks.group.srcService.attrs = cn description memberUid

lsc.tasks.group.srcService.baseDn = ou=groups

lsc.tasks.group.srcService.filterAll = (objectClass=groupOfNames)

lsc.tasks.group.srcService.filterId = (&(objectClass=groupOfNames)(cn={cn}))

lsc.tasks.group.srcService.pivotAttrs = cn

lsc.tasks.group.dstService = org.lsc.jndi.SimpleJndiDstService

lsc.tasks.group.dstService.attrs = cn description member objectClass

lsc.tasks.group.dstService.baseDn = ou=groups

lsc.tasks.group.dstService.filterAll = (objectClass=group)

lsc.tasks.group.dstService.filterId = (&(objectClass=group)(cn={cn}))

lsc.tasks.group.dstService.pivotAttrs = cn

lsc.syncoptions.group = org.lsc.beans.syncoptions.PropertiesBasedSyncOptions

lsc.syncoptions.group.default.action = F

lsc.syncoptions.group.objectClass.force_value = "top";"group"

lsc.syncoptions.group.member.delimiter = $

lsc.syncoptions.group.member.force_value = \

var umembers = srcBean.getAttributeValuesById("memberUid").toArray() ; \

for (var i=0; i

try { \

umembers[i] = ldap.attribute(ldap.list( "cn=users" ,"(sAMAccountName=" + (umembers[i]) + ")").get(0), 'distinguishedname').get(0) \

} catch (e) { \

umembers[i]=null \

} \

} \

var members = new Array(); \

var j=0; \

for (var i=0; i

if (umembers[i]!=null) members[j++]=umembers[i] \

} \

members