I am not sure if what I am expecting is supposed to work the way i envision it.
We have freeipa 4.6.5 and MS ad 2016.
All works well for system logins ,
ad users can ssh to hosts enrolled to freeipa/
we also have a few web ui;s zabbix, custom app, that currently authenticate Freeipa users
using ldap only.
I was under the impression that Freeipa could determine the user is not an ipa user but an
ad user based on the supplied domain and them perform the authentication against the AD.
For this i would then need to change the bind and base dn on the respective applications.
the question is.
in an ipa-ad trust relationship, can we still use the basic ldap authentication for both
internal (ipa) and external (ad) users?
What base, bind DN do we need to set to enable this?
i.e.
we now have
"cn=users,cn=accounts,dc=EXAMPLE,dc=EXAMPLE,dc=COM"
do we need to change this to (i saw this in the ipa ldap logs a lot)
"cn=Default Trust View,cn=views,cn=accounts,dc=EXAMPLE,dc=EXAMPLE,dc=COM"
Kind regards