synchronization

problem: you have one directory A with users and groups, and want that to be synchronized with directory B. however, any user not in A should remain in B, but without any membership to any group.

constraint: minimize system downtime, ie the time users are unnecessarily removed from the system or a group.

solution:

1. grab all users and groups from A
   
2. add missing users to B
   
3. compare existing groups in A and B and delete from B those that don't exist in A
   
4. loop over groups in B
   
   1. for each group in B, loop through all users
      
   2. if the user does not have group membership in A, remove it from B
5. go through all users in A and add them to the corresponding groups in B

result: no down-time at all.

do you have any better solutions?