On pe, 18 touko 2018, Marc Boorshtein via FreeIPA-users wrote:
I'm working with the ipa web services to provision users across a
one
way trust with IPA. I have looked at the id_view_* services and am
trying to wrap my head around a few details:
1. When I ssh into a linux box thats a member of the IPA domain with
my AD user IPA creates an object in LDAP and assigns a gid and uid to
it, but when i create the user in the ID View under the Default Trust
View the information from the object isn't there, BUT when I set the
shell it gets written to the directory object when I update the shell
attribute. Shouldn't the user's gid/uid be visible there as part of
the view?
IPA does not create any specific object in LDAP when you are ssh-ing
into a Linux box. That simply does not happen and never was.
Can you demonstrate what you are talking about with a concrete example
using 'ipa idoverrideuser-*' commands?
2. When I add a user from AD to an external group should I specify
the userPrincipalName as the external member?
You should specify something that SSSD
will be able to resolve to an AD
user. It could be username@domain or NetBIOS\username or anything else
that SSSD could resolve.
3. Is there a way to get IPA to trigger the creation of the ldap
object that represents the AD user via a web service instead of
logging in or sudoing over to that user?
No. And both sudoing or logging in into the
host does not create the
LDAP object as well. You as administrator should create those entries.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland