Groups for the relay nodes (all nodes managed by...) should not be synced, or mapped, since QA and PROD would have different relay nodes.

Not API exposed, needs to be able to detect the existance and make use of feature once it's exposed.

Depends on API issue, need to detect and alert correctly based on the error.

Allow introspection of objects on sender and receiver side,

Benefits

• to avoid non-neccessary updating (will match LDAP ldapadd -c behaviour and
• also on-the fly adjustments like insertion of missing exlucdes) when a new object is added

Exclude some groups from deletion by naming convention

The script checks for groups that aren't in QA but in PROD. It'll assume them deleted and remove them.
Some groups may only exist on the PROD server and should be exempt.

Examples:

• "EMERGENCY" for changes if QA sync is not approved or QA server is failed
• "REPORT" Groups that are mostly dynamic groups like for adhoc-queries.