On to, 17 tammi 2019, lejeczek via FreeIPA-users wrote:
On 16/01/2019 21:17, Alexander Bokovoy wrote:
>On ke, 16 tammi 2019, lejeczek via FreeIPA-users wrote:
>>hi guys
>>
>>After a longer break from Windowze, I had Win2012 trust okey in
>>the past, now I'm fiddling with Win2016 and have this question:
>>
>>After trust (one-way coming from AD) established okey should AD's
>>users be immediately available to/in IPA?
>>
>>Usual things such as id, ipa user-show do find them users. I
>>cannot remember how it was with my Win2012.
>There should be no difference in functional behavior.
>
>Perhaps, you were lucky in terms of establishing trust at a time when
>SSSD on IPA master decided to refresh its domain information and
>discovering it has new trusted domains to look at.
>
Do we users/admins have any/some control over those bits, over how
SSSD refreshes & caches this bits?
I've decided to briefly try with 2016 "lab" type, my own 2016 I
control. I get users immediately with one-way (full credentials and no
shared secret) trust but only on the master which established the
trust, remaining master though they can validate the trust with
kvno/kinit they at the moment see no AD users with id/getent/ipa user.
Reading docs I could not get this clarified, I suppose but having this
crystal clear would be best - ipa-adtrust-install is only needed on
that one master which will establish the trust and does need to be on
each IPA's master?
Correct, ipa-adtrust-install needs to be run on one master to
configure
that one as a trust controller role. Other masters can be designated as
trust agents via re-run of 'ipa-adtrust-install --add-agents' on the
original master. If you want to have more trust controllers, you can
initialize them by runnning ipa-adtrust-install on those masters but
this is not required. This all is described in the documentation.
Unless you designated IPA masters as trust agents or trust controllers,
they will not be able to resolve AD users/groups. It is a security
feature as having access to inter-forest trust credentials allows to
impersonate the whole trust link. Thus, by default the access to these
credentials is limited and have to be granted via 'ipa-adtrust-install
--add-agents' from a master with a trust controller role.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland