On the IdM server, configure the server to use cross-forest trust
.
Procedure
Enable HBAC:
Configure sssd to transfer additional attributes of AD users.
Add the AD user attributes to the nss and domain sections in /etc/sssd/sssd.conf
.
For example:
[nss] user_attributes=+mail, +sn, +givenname [domain/EXAMPLE] ldap_user_extra_attrs=mail, sn, givenname