On to, 19 joulu 2019, Rami Elias (TECH V) via FreeIPA-users wrote:
Hello,
thank you for your fast investigation;
we are on centos 8 and we have the following packages:
- name: install freeipa packages
dnf:
name:
- ipa-server
- ipa-server-dns
- ipa-server-trust-ad
- ipa-idoverride-memberof-plugin
state: installed
yes, im sorry for that idiotic formatting, my mail client somehow
removed the newlines i was just able to see it after i already sent it
..
we got it working by the link you provided:
ipa group-add-member u0-erdberg-verwaltung --idoverrideusers=ad_user(a)ad.example.com
so really thank you for your help, just one LAST question:
is this somehow possible on group basis? (id override group?) we dont
want to have to manage all of our ad users we want to manage some
groups in which are assigned to the users?
No, using group overrides is not possible at the moment. It is way more
complex to add that supported on ACI enforcement side, sorry. Pretty
much the same level of complexity as handling external group members.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland