On pe, 18 loka 2019, Pieter Baele wrote:
> >By adding a domain_realm mapping to a windows client, also
describe on
> >FreeIPA-users before, the routing problem is solved. But I (and especially
> >the AD admins ;-) ) would prefer to solve the underlying issue.
> Don't use external trust, use forest trust. The effect you see is a
> design limit of external trust.
>
The AD admins don't trust IdM ;-)
Their Microsoft consultant/expert also thinks we are doing dangerous things.
Conclusion:
- they either have to choose between applying the GPO
- or forest trust.
I understand completely, because there was a precedent because of some old
interconnection between Samba as PDC and the AD domain.
This required the AD domain to stay on an old functional level.
Same thing with enctypes in Kerberos tickets
I don't see how this applicable.
FreeIPA is using the same method
(forest trust) as Active Directory. Even Active Directory itself sees it
as another Active Directory deployment. Forest trust has clear
demarcation in terms of SID filtering and Kerberos ticket policy
processing.
As you said, it is hard to find people who actually understand these
complex technologies...
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland