Use ADS_SYNC_BYPASS to avoid sync of capability attribute - Identity Manager
Article ID: 76855
Updated On:
Products
Issue/Introduction
In a sync process (regardless of weak / strong) if the eTADSaccountExpires account attribute value is an expiry date (a value <> 0 and <> 9223372036854775807) and
the account template comes as "Never Expires" (eTADSaccountExpires=0) then the sync query will request to change the account value to "Never Expires" (eTADSaccountExpires=0).
And Client does not want this change. The reason why the Client does not want this update is because their ADS proxy ID has not enough rights to perform this operation.
They just want the sync process to perform the group membership assignments.
Environment
Release: 14.x, 15.x
Component: Identity Manager
Cause
Usually with weak synchronization, capabilities are never lowered.
This is an exception with eTADSaccountExpires, (hence it is coded into the ADS server slapd plug-in) - since eTADSaccountExpires=0 means "Never Expires" it is stronger than any expiry date values and so the usual slapd behavior is changed into the ADS server slapd plug-in.
Resolution
There are few options to bypass the sync of eTADSaccountExpires.
For 14.x version:
First option:
The ADS_SYNC_BYPASS should be set on both the C++ Connector Server service and on the Provisioning Server (IMPS).
If the Provisioning Server is running on Linux you would need to set the variable in the profile of the ID used to start the Provisioning Server.
With VAPP, for example, you would do the following:
1. Log into the vapp with config user
2. su - imps
3. vi /etc/.profile_imps
4. add the export ADS_SYNC_BYPASS=AttributeName1;AttributeName2;
5. exit out of the su - imps
6. stop_ps
7. start_ps
On the External Windows C++ Connector Server you would do the following:
1. Go to Computer Advanced Settings
2. Add the System Environment Variable ADS_SYNC_BYPASS=eTADSaccountexpires;
3. Stop the JCS and CCS
4. Start the JCS and CCS
Second option:
Manually adjusting the account template:
Open a LDAP browser (e.g. JXplorer) against the etadb.
(Port: "20391" - Base DN: "dc=etadb" - User DN: "eTDSAContainerName=DSAs,eTNamespaceName=CommonObjects,dc=etadb" - DSA password)
Go to your ADS template branch:
eTADSPolicyName=<YourADSTemplate>,eTADSPolicyContainerName=Active Directory Policies,eTNamespaceName=CommonObjects,dc=im,dc=etadb
Unset the eTADSaccountExpires attribute value, so that there is no value for this attribute.
Trigger again a sync process with this weak sync template to change the groups membership.
No attempt to update the eTADSaccountExpires is made. In addition, if this template is used to create new accounts, they will be created as never expires.
For version 15.x
1. Identify every IMPS node. If this is a clustered/multi-node deployment, this fix must be applied on every node — a variable set on one node has no effect on slapd processes running on the others.
2. On each IMPS node, create or edit the environment override file:
/opt/brcm/iga/conf/imps/env.sh
This file does not exist by default (it's an optional customer hook, sourced conditionally by the startup script if present). Create it if missing:
mkdir -p /opt/brcm/iga/conf/imps
cat > /opt/brcm/iga/conf/imps/env.sh << 'EOF'
export ADS_SYNC_BYPASS=eTADSaccountExpires
EOF
- Use export, not a bare assignment — the variable must propagate into the slapd process environment.
- Set ownership to match the IMPS service account (check with stat -c '%U' /opt/brcm/iga; typically igx).
- To bypass multiple attributes, separate with semicolons: ADS_SYNC_BYPASS=eTADSaccountExpires;eTADSlogonHours
3. Fully stop and restart the IMPS service on each node — a config change alone does nothing until slapd is respawned; a signal-reload is not sufficient.
ps -ef | grep slapd # note current PID(s)
# stop the im_ps service via your normal service control method
ps -ef | grep slapd # confirm no process remains
# start the im_ps service
4. Verify the variable actually reached the new process before testing further:
ps -ef | grep slapd # get the new PID
cat /proc/<PID>/environ | tr '\0' '\n' | grep ADS_SYNC_BYPASS
Expected output: ADS_SYNC_BYPASS=eTADSaccountExpires.
If this is empty, the service was not actually restarted, or env.sh is missing/misplaced on that node — repeat steps 2–3 before proceeding.
Additional Information
Can also be helpful to avoid updating the mailbox size by using the eTADSmDBUseDefaults attribute.
Feedback
