Syncing OpenLDAP to AD, using LSC - active-directory

Question

I am trying to setup LSC to periodically sync users data from OpenLDAP to AD.
I was able to populate the AD once, with data from OpenLDAP by following this procedure. However:
Not all users where copied and I can't figure out why
When I run LSC again, it tries to add the data that was already copied once more (and fails for a duplicate key, of course).
I guess I am missing something very basic here about how to tell LSC to update, not add user data that already exists. I tried very out to figure that out from the documentation but it seems to be very lacking.
So if anyone could share some insights and maybe an example of a config file, that would be much appreciated...
Best,
Oren
--- my lsc.xml below ---
<?xml version="1.0" ?>
<!--
In the following file, comments are describing each node. Elements are
referenced through XPath expression, whereas attributes are prefixed with
'#'
//lsc Root node of the XML configuration file
#xmlns XML Schema validation is not ready yet (Reserved for futur use)
#id optional, added by XML API
#revision mandatory, used by the Web Administration Interface to version
this file
-->
<lsc xmlns="http://lsc-project.org/XSD/lsc-core-2.1.xsd" revision="0">
<!-- ./connections Connections list node, must contain at least two connections -->
<connections>
<ldapConnection>
<name>AD</name>
<url>ldaps://my-ad-server/DC=tcs,DC=local</url>
<username>CN=TestLDAP,OU=Users,OU=Linux,DC=tcs,DC=local</username>
<password>*****</password>
<authentication>SIMPLE</authentication>
<pageSize>1000</pageSize>
<tlsActivated>false</tlsActivated>
</ldapConnection>
<ldapConnection>
<name>ldap.cs</name>
<url>ldap://my-ldap-server/dc=cs,dc=huji,dc=ac,dc=il</url>
<username>cn=myuser,ou=users,dc=cs,dc=huji,dc=ac,dc=il</username>
<password>nothing</password>
<authentication>NONE</authentication>
</ldapConnection>
</connections>
<!-- ./audits Audits list node -->
<audits>
<!--./audit Audit node, here a CSV audit, may also be a LDIF or any contributed audit type -->
<csvAudit>
<!-- ./name mandatory, audit name -->
<name>csv</name>
<!-- ./append optional, default to false, specify to create a new log file or to append to the existing one -->
<append>true</append>
<!-- ./operations optional, comma separated list of operations (create, delete, update or rename) -->
<operations>create, delete</operations>
<!-- ./file mandatory, define the location of the file where the CSV data will be written -->
<file>/tmp/dump.csv</file>
<!-- ./datasets optional, comma separated list of datasets modification to log -->
<datasets>cn, dn</datasets>
<!-- ./separator optional, default to ";", specify the values separator -->
<separator>,</separator>
</csvAudit>
</audits>
<!-- ./tasks Task list node, must contain at least one task -->
<tasks>
<task>
<name>adUser</name>
<bean>org.lsc.beans.SimpleBean</bean>
<ldapSourceService>
<name>openldap-source-service</name>
<connection reference="ldap.cs" />
<baseDn>ou=users,dc=cs,dc=huji,dc=ac,dc=il</baseDn>
<pivotAttributes>
<string>uidNumber</string>
</pivotAttributes>
<fetchedAttributes>
<string>cn</string>
<string>description</string>
<string>givenName</string>
<string>mail</string>
<string>sn</string>
<string>uid</string>
<string>uidNumber</string>
<string>userpassword</string>
</fetchedAttributes>
<getAllFilter><![CDATA[(objectClass=inetOrgPerson)]]></getAllFilter>
<getOneFilter><![CDATA[(&(objectClass=inetOrgPerson)(uidNumber={uidNumber}))]]></getOneFilter>
<cleanFilter><![CDATA[(&(objectClass=inetOrgPerson)(uidNumber={uidNumber}))]]></cleanFilter>
</ldapSourceService>
<ldapDestinationService>
<name>ad-dst-service</name>
<connection reference="AD" />
<baseDn>OU=Users,OU=Linux,DC=tcs,DC=local</baseDn>
<pivotAttributes>
<string>sAMAccountName</string>
</pivotAttributes>
<fetchedAttributes>
<string>cn</string>
<string>description</string>
<string>givenName</string>
<string>mail</string>
<string>objectclass</string>
<string>pwdLastSet</string>
<string>sAMAccountName</string>
<string>sn</string>
<string>unicodePwd</string>
<string>userAccountControl</string>
<string>userPrincipalName</string>
</fetchedAttributes>
<getAllFilter><![CDATA[(objectClass=user)]]></getAllFilter>
<getOneFilter><![CDATA[(&(objectClass=user)(sAMAccountName={uid}))]]></getOneFilter>
</ldapDestinationService>
<propertiesBasedSyncOptions>
<mainIdentifier>"cn=" + srcBean.getDatasetFirstValueById("cn") + ",CN=Users,CN=linux,DC=tcs,DC=local"</mainIdentifier>
<defaultDelimiter>;</defaultDelimiter>
<defaultPolicy>FORCE</defaultPolicy>
<conditions>
<create>true</create>
<update>true</update>
<delete>true</delete>
<changeId>true</changeId>
</conditions>
<dataset>
<name>objectclass</name>
<policy>FORCE</policy>
<createValues>
<string>"user"</string>
<string>"organizationalPerson"</string>
<string>"person"</string>
<string>"top"</string>
</createValues>
</dataset>
<dataset>
<name>sAMAccountName</name>
<policy>FORCE</policy>
<createValues>
<string>srcBean.getDatasetFirstValueById("uid")</string>
</createValues>
</dataset>
<!-- userPrincipalName = uid + "#cs.huji.ac.il"
<dataset>
<name>userPrincipalName</name>
<policy>MERGE</policy>
<forceValues>
<string>srcBean.getDatasetFirstValueById("uid") + "#cs.huji.ac.il"</string>
</forceValues>
</dataset -->
<dataset>
<name>userAccountControl</name>
<policy>FORCE</policy>
<createValues>
<string>AD.userAccountControlSet( "0", [AD.UAC_SET_NORMAL_ACCOUNT])</string>
</createValues>
</dataset>
<dataset>
<!-- pwdLastSet = 0 to force user to change password on next connection -->
<name>pwdLastSet</name>
<policy>FORCE</policy>
<createValues>
<string>"0"</string>
</createValues>
</dataset>
<!-- unicodePwd = "changeit" at creation (requires SSL connection to AD) -->
<dataset>
<name>unicodePwd</name>
<policy>FORCE</policy>
<createValues>
<string>AD.getUnicodePwd("{unicodePWD}")</string>
</createValues>
</dataset>
</propertiesBasedSyncOptions>
</task>
</tasks>
<!-- ./security This mandatory node contains the security settings used by LSC -->
<security>
<!-- ./encryption This optional node contains the encryption settings -->
<encryption>
<!-- ./keyfile This optional node contains the keyfile location -->
<keyfile>etc/lsc.key</keyfile>
<!-- ./algorithm This optional node contains the encryption algorithm -->
<algorithm>AES</algorithm>
<!-- ./strength This optional node contains the algorithm key length -->
<strength>128</strength>
</encryption>
</security>
</lsc>