My use case on AWS involves ephemeral or auto-scaling servers that do not live long enough to justify a formal IPA enroll/un-enroll process.

We have a great AD-integrated IPA system running at the moment and I've been able to configure a light test client that trusts the IPA CA certificate and will become an LDAPS client of the FreeIPA server

This works great for local IPA users but I'm trying to think this through and I'm not sure if I can use LDAP to authenticate an AD user? Is this even possible?

This is my working sssd.conf for a test client that just uses LDAP -- works great for resolving users and groups that are local IPA users but so far I can't resolve any of the AD resident users:

[domain/default]
autofs_provider = ldap
cache_credentials = True
ldap_search_base = cn=users,cn=accounts,dc=ipa,dc=example,dc=com
ldap_group_search_base = cn=groups,cn=accounts,dc=ipa,dc=example,dc=com
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldap://ipa001.ipa.example.com/
ldap_id_use_start_tls = True
ldap_tls_cacertdir = /etc/pki/tls/
default_shell = /bin/bash
override_shell = /bin/bash


Is there any method using ldap_search_base or an override of the Default Trust View that would allow me to deploy a client that only talks LDAP to FreeIPA but is able to resolve and authenticate AD users?  I'm wondering if this is even possible or if I'm looking at a lost cause. Thanks!

Chris