On Fri, Oct 18, 2019 at 8:26 AM Alexander Bokovoy <abokovoy@redhat.com> wrote:
On pe, 18 loka 2019, Pieter Baele wrote:
>All Windows clients are properly enrolled into the AD domain.
>
>We can't use two-way trust because of reasons you explained here before. A
>one-way external trust is used. All perfectly established and working, but
>somehow windows clients don't follow the topology.
Ok, so this is the key information you did not say in the original
email. ;)

Yeah. Sorry :-)
 
External trust only works for the domain you trust directly, not for
....


Perfect explanation.
 


>By adding a domain_realm mapping to a windows client, also describe on
>FreeIPA-users before, the routing problem is solved. But I (and especially
>the AD admins ;-) ) would prefer to solve the underlying issue.
Don't use external trust, use forest trust. The effect you see is a
design limit of external trust.

The AD admins don't trust IdM ;-)
Their Microsoft consultant/expert also thinks we are doing dangerous things.
Conclusion: 
- they either have to choose between applying the GPO
- or forest trust.

I understand completely, because there was a precedent because of some old interconnection between Samba as PDC and the AD domain.
This required the AD domain to stay on an old functional level.
Same thing with enctypes in Kerberos tickets
 

>Thanks a lot, it is quite hard to find experts (with knowledge of both
>LDAP, AD and different Kerberos implementations)(we are reaching out to RH)
If you are reaching out to Red Hat support, your request will eventually
get to my hands.

I know. Sometimes difficult when there is other support people in-between....

Thanks a lot, this made things very very clear