On 15.06.21 08:42, Alexander Bokovoy via FreeIPA-users wrote:
[...]
Check the first link I gave. Only 'domain local' groups can include
members from "Accounts, Global groups, and Universal groups from other
forests and from external domains". Domain local groups, on the other
hand, can only be used inside the domain they defined.
Thus, such groups cannot be used over a trust to IPA.
I was not aware that only 'domain local' groups allow members from other
forests and/or domains. I know that 'domain local' groups cannot be used
in IPA.
The group my colleague created is a 'domain local' group although I told
them many times not to create local groups because they cannot be used
in IPA...
Thanks a lot for clarification. I think I do have a better picture now.
Is it true that the main use case for creating an 'external' trust is to
establish a trust to just one domain of a forest?
Cheers,
Ronald