On 06/03/18 07:28, Florence Blanc-Renaud wrote:
On 05/03/2018 19:01, lejeczek via FreeIPA-users wrote:
> hi guys
>
> I wonder if it is(would be) possible to have IPA join AD but
> so IPA admin only asks AD admin(s) to do whatever is
> required and then s/he does IPA end?
> And a reason you would do that is - domains are formally(and
> in other ways) separate that AD admin would have to keep
> secret and not share any of those AD credentials you would
> normally use in IPA to add such a trust.
>
> many thanks, L.
> _______________________________________________
> FreeIPA-users mailing list --
> freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
Hi,
it is possible to use a shared secret instead of the AD
admin credentials when establishing the trust:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
Does this address your concern?
Flo
That might be exactly it!
I'm trying "one way" and while the command succeeded I saw this:
...
Domain Security Identifier:
S-1-5-21-3110176660-1847390102-3050341588
SID blacklist incoming: S-1-0, S-1-1, S-1-2, S-1-3,
S-1-5-1, S-1-5-2, S-1-5-3, S-1-5-4, S-1-5-5,
S-1-5-6, S-1-5-7, S-1-5-8,
S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12, S-1-5-13,
S-1-5-14, S-1-5-15, S-1-5-16,
S-1-5-17, S-1-5-18, S-1-5-19, S-1-5-20
SID blacklist outgoing: S-1-0, S-1-1, S-1-2, S-1-3,
S-1-5-1, S-1-5-2, S-1-5-3, S-1-5-4, S-1-5-5,
S-1-5-6, S-1-5-7, S-1-5-8,
S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12, S-1-5-13,
S-1-5-14, S-1-5-15, S-1-5-16,
S-1-5-17, S-1-5-18, S-1-5-19, S-1-5-20
Trust direction: Trusting forest
Trust type: Active Directory domain
Trust status: Waiting for confirmation by remote side
gidnumber: 1416100000
ipantsecurityidentifier:
S-1-5-21-690266907-396463273-2110627865-1004
ipantsupportedencryptiontypes: 28
ipanttrustdirection: 1
...
Now I'm trying to ssh to IPA as:
$ ssh adm@ad.priv.dom.local(a)10.1.1.1
but this fails as if the password was incorrect, which
naturally is not true.
Is the problem "one way" trust?
many thanks, L.