On 16/01/2019 19:26, John Keates wrote:
There is no enumeration support, but if you want to figure out if
your connection works, try getent on a group or user (or using id on a group or user). If
those don’t work the AD Trust might not be working correctly.
I start the trusts on the IPA side and use Domain Admin creds (and not a secret or
token), that always works for me.
If the trust works but something else is wrong, you can check if the trusts are listed
and domains can be fetched from the trust. If you don’t even have those, the trust doesn’t
work at all. If do you have those it’s a different problem.
Does the trust show on the DC in the trust settings?
Trust does show in 2016 DC but because it was started there, that trust
was set up with a shared secret on 2016 and then finished off on IPAs.
The thing is - I do not have(and cannot have) admin access/credentials
on 2016 AD and in such cases I understand, only shared key is the option
available. Or nor not?
Regards,
John
> On 16 Jan 2019, at 19:19, lejeczek via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
>
> hi guys
>
> After a longer break from Windowze, I had Win2012 trust okey in the past, now I'm
fiddling with Win2016 and have this question:
>
> After trust (one-way coming from AD) established okey should AD's users be
immediately available to/in IPA?
>
> Usual things such as id, ipa user-show do find them users. I cannot remember how it
was with my Win2012.
>
> many thanks, L.
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...