On Tue, Feb 06, 2018 at 02:30:00PM -0600, Amos wrote:
On Tue, Feb 6, 2018 at 2:16 PM, Jakub Hrozek via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
>
> If you don't want to bother with the POSIX attributes on the AD side,
> you can perhaps use ID overrides? See
>
https://access.redhat.com/documentation/en-us/red_hat_
> enterprise_linux/7/html/linux_domain_identity_authentication_and_policy_
> guide/id-views
> for example.
>
Then how do UID/GID get generated? Automatically within IPA?
For any entry that doesn't get its attributes overlayed with the
data coming from the ID views, yes.
If so, if I
first imported my existing Sun LDAP directory, I guess IPA would then
auto-generate the UID/GID for new accounts subsequently found in AD, but
since they existing accounts were loaded from Sun LDAP, no changes for them.
I may have misunderstood your setup, but IIUC your users would live in
AD right? Then what I was proposing was that you don't put any POSIX
attributes into newly created users, ignore any existing POSIX data you
might have in AD while creating the trust and and just migrate those that
you already have into ID views.