On 14/11/2019 11:44, Alexander Bokovoy wrote:
On to, 14 marras 2019, lejeczek via FreeIPA-users wrote:
> hi guys
>
> I've have AD trust work fine (gssapi), ssh & samba are password-less
> when the trust is establish with 'admin' credentials.
>
> But the strory is very different with 'shared secret'. Kerberos does not
> work, passwords are asked for and with Windows cifs - asks for username
> and no authentication even with passwords!
>
> And this weird bit, I do:
>
> $ ipa trust-add --all --two-way=0 --type=ad bec.private.mac.ac.uk
> --trust-secret --server=win8-vm.bec.private.mac.ac.uk
>
> Shared secret for the trust:
>
> ...
>
> Here, for the 'secret' I can punch in anything and IPA will say that the
> trust was added successfully - this surely must not be right, right?
>
> So, should 'secret' work for one-way incoming trust in IPA? To me, it
> does not seem like.
It very much depends what RHEL/CentOS version do you use. What
ipa-server package version? You need RHEL 7.7 as a base.
IPA version in the subject. I'm on Centos 7.7.1908.
thanks, L.
See
https://bugzilla.redhat.com/show_bug.cgi?id=1757507
However, there is a catch. If you have more than one domain in your IPA
deployment that is not subdomain of the primary IPA domain (e.g.
example.test and anotherdomain.test where example.test is primary IPA
domain), then GSSAPI authentication to anotherdomain.test would not work
from Windows machines. This is because we don't yet have implementation
of the APIs expected by Active Directory domain controllers to retrieve
the forest topology from IPA side and we cannot update it on AD DC side
from IPA without admin credentials.