I'm working with the ipa web services to provision users across a one
way trust with IPA. I have looked at the id_view_* services and am
trying to wrap my head around a few details:
1. When I ssh into a linux box thats a member of the IPA domain with
my AD user IPA creates an object in LDAP and assigns a gid and uid to
it, but when i create the user in the ID View under the Default Trust
View the information from the object isn't there, BUT when I set the
shell it gets written to the directory object when I update the shell
attribute. Shouldn't the user's gid/uid be visible there as part of
2. When I add a user from AD to an external group should I specify
the userPrincipalName as the external member?
3. Is there a way to get IPA to trigger the creation of the ldap
object that represents the AD user via a web service instead of
logging in or sudoing over to that user?