On ke, 23 tammi 2019, lejeczek via FreeIPA-users wrote:
On 17/01/2019 11:43, Alexander Bokovoy wrote:
> On to, 17 tammi 2019, lejeczek via FreeIPA-users wrote:
>> On 16/01/2019 19:26, John Keates wrote:
>>> There is no enumeration support, but if you want to figure out if
>>> your connection works, try getent on a group or user (or using id on
>>> a group or user). If those don’t work the AD Trust might not be
>>> working correctly.
>>> I start the trusts on the IPA side and use Domain Admin creds (and
>>> not a secret or token), that always works for me.
>>>
>>> If the trust works but something else is wrong, you can check if the
>>> trusts are listed and domains can be fetched from the trust. If you
>>> don’t even have those, the trust doesn’t work at all. If do you have
>>> those it’s a different problem.
>>>
>>> Does the trust show on the DC in the trust settings?
>>
>> Trust does show in 2016 DC but because it was started there, that
>> trust was set up with a shared secret on 2016 and then finished off
>> on IPAs.
> Ah. One-way trust with a shared secret is not supported yet. I need to
> merge my patches, hopefully, somewhere after devconf/FOSDEM. It requires
> changes to Samba (released in 4.7.11+, 4.8.6+), to SSSD (released in
> 1.16.3+), and to FreeIPA (not merged yet).
>
>> The thing is - I do not have(and cannot have) admin
>> access/credentials on 2016 AD and in such cases I understand, only
>> shared key is the option available. Or nor not?
> I have Windows Server 2016 deployment and I have access to admin creds
> there without any problems. Unless you are trying to say that your
> administrators don't like to give you temporary membership in a 'Domain
How temporary would that have to be?
Is it just for them time when IPA adds a trust and such admin access can
be removed right after that?
Yes, just at that time.
What when one needs to add a controller at later time, and related
stuff?
Adding a trust controller is unrelated to adding a trust itself.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland