On ti, 15 kesä 2021, Ronald Wimmer via FreeIPA-users wrote:
On 15.06.21 08:42, Alexander Bokovoy via FreeIPA-users wrote:
>[...]
>Check the first link I gave. Only 'domain local' groups can include
>members from "Accounts, Global groups, and Universal groups from other
>forests and from external domains". Domain local groups, on the other
>hand, can only be used inside the domain they defined.
>
>Thus, such groups cannot be used over a trust to IPA.
I was not aware that only 'domain local' groups allow members from
other forests and/or domains. I know that 'domain local' groups cannot
be used in IPA.
The group my colleague created is a 'domain local' group although I
told them many times not to create local groups because they cannot be
used in IPA...
Thanks a lot for clarification. I think I do have a better picture now.
Is it true that the main use case for creating an 'external' trust is
to establish a trust to just one domain of a forest?
On Active Directory side external trust is often used to perform a
shortcut in an authentication request processing. This is often needed
if you have a deep hierarchy of child domains in a forest and you only
want to have a trust to a specific child domain. This allows to avoid
going through parent domains' domain controllers for each Kerberos or
identity resolution request.
Another reason is that people often use external trust in a situation
where they have organizational barriers to set up a proper forest trust.
Both of these could apply to IPA to AD trust as well. As always, one
needs to carefully plan the deployment in advance, as external trust has
clear limitations.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland