We are observing a strange behavior with the AD provisioning in 7.1.3, that might be a basic configuration issue.
We have different AD domains configured via variable sets in the same sync project.
We can add users and computers to AD groups of different realms, however, we can not remove them.
From IM point of view, the memberships have been removed just fine. The provisioning logs state that the action for the AD group has been successful for Update vrtMembersSID with a minus (-) and the SID of the object to be removed, as expected. The problem is, that the membership in question still remains in AD, although is was "successfully" deprovisioned.
I understand there are some implications when dealing with cross-domain memberships, that need to be taken into account. I assumed that the AD connector handles these things. Did we miss something? It is particulalry strange that we can ADD but not REMOVE such memberhsips. Is there a way to enable more detailed provisioning logs?
