On 17/01/2019 11:43, Alexander Bokovoy wrote:
On to, 17 tammi 2019, lejeczek via FreeIPA-users wrote:
> On 16/01/2019 19:26, John Keates wrote:
>> There is no enumeration support, but if you want to figure out if
>> your connection works, try getent on a group or user (or using id on
>> a group or user). If those don’t work the AD Trust might not be
>> working correctly.
>> I start the trusts on the IPA side and use Domain Admin creds (and
>> not a secret or token), that always works for me.
>>
>> If the trust works but something else is wrong, you can check if the
>> trusts are listed and domains can be fetched from the trust. If you
>> don’t even have those, the trust doesn’t work at all. If do you have
>> those it’s a different problem.
>>
>> Does the trust show on the DC in the trust settings?
>
> Trust does show in 2016 DC but because it was started there, that
> trust was set up with a shared secret on 2016 and then finished off
> on IPAs.
Ah. One-way trust with a shared secret is not supported yet. I need to
merge my patches, hopefully, somewhere after devconf/FOSDEM. It requires
changes to Samba (released in 4.7.11+, 4.8.6+), to SSSD (released in
1.16.3+), and to FreeIPA (not merged yet).
> The thing is - I do not have(and cannot have) admin
> access/credentials on 2016 AD and in such cases I understand, only
> shared key is the option available. Or nor not?
I have Windows Server 2016 deployment and I have access to admin creds
there without any problems. Unless you are trying to say that your
administrators don't like to give you temporary membership in a 'Domain
Admins' group in the forest root domain or in 'Enterprise Admins' group
to allow creating a forest trust, you should definitely be able to use
admin credentials to establish trust. Windows Server 2016 is no
different from 2012 in this sense.
I'm not trying, I'm saying that indeed.
I remember now that I asked around of the same "issue" when I first came
across it time ago when I fiddled with 2012.
If I did not say it then, but if I did then I'll repeat - in big
organizations like one I work for where often organizationally formal
separation exist to some extent, that "shared secret" - I could not
stress enough - the sooner it gets into IPA (fully working) the more
lives and problems are saved :)
I'll keep my fingers cross hard :)
many! thanks. L.