On ti, 15 kesä 2021, Ronald Wimmer via FreeIPA-users wrote:
On 15.06.21 08:42, Alexander Bokovoy via FreeIPA-users wrote:
>Check the first link I gave. Only 'domain local' groups can include
>members from "Accounts, Global groups, and Universal groups from other
>forests and from external domains". Domain local groups, on the other
>hand, can only be used inside the domain they defined.
>Thus, such groups cannot be used over a trust to IPA.
I was not aware that only 'domain local' groups allow members from
other forests and/or domains. I know that 'domain local' groups cannot
be used in IPA.
The group my colleague created is a 'domain local' group although I
told them many times not to create local groups because they cannot be
used in IPA...
Thanks a lot for clarification. I think I do have a better picture now.
Is it true that the main use case for creating an 'external' trust is
to establish a trust to just one domain of a forest?
On Active Directory side external trust is often used to perform a
shortcut in an authentication request processing. This is often needed
if you have a deep hierarchy of child domains in a forest and you only
want to have a trust to a specific child domain. This allows to avoid
going through parent domains' domain controllers for each Kerberos or
identity resolution request.
Another reason is that people often use external trust in a situation
where they have organizational barriers to set up a proper forest trust.
Both of these could apply to IPA to AD trust as well. As always, one
needs to carefully plan the deployment in advance, as external trust has
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland