You can set up a schedule for the Service Manager to periodically synchronize the list of users and groups in the LDAP security domain with the list of users and groups in the LDAP directory service.
Before you start the synchronization process, verify that the /etc/hosts file contains an entry for the host name of the LDAP server. If the Service Manager cannot resolve the host name for the LDAP server, the user synchronization can fail.
During synchronization, the Service Manager imports users and groups from the LDAP directory service. The Service Manager deletes any user or group from the LDAP security domain that is no longer included in the search filters used for the import.
By default, the Service Manager does not have a scheduled time to synchronize with the LDAP directory service. To ensure that the list of users and groups in the LDAP security domains is accurate, you can schedule the times during the day when the Service Manager synchronizes the LDAP security domains. The Service Manager synchronizes the LDAP security domains with the LDAP directory service every day at the times you set.
During synchronization, the Service Manager locks the user account that it synchronizes. When the user account is locked, the Service Manager cannot authenticate the user account. Users might not be able to log in to application clients. If users are logged in to application clients when synchronization starts, the users might not be able to perform tasks. The duration of the synchronization process depends on the number of users and groups to be synchronized. To avoid usage disruption, synchronize the security domains during times when most users are not logged in.
To synchronize more than 100 users or groups, enable paging on the LDAP directory service before you run the synchronization. If you do not enable paging on the LDAP directory service, the synchronization can fail.
To set up a schedule to synchronize the LDAP security domains with the LDAP directory service, perform the following steps: