Thanks for the feedback Alexander. How would things like HBAC by group work
In that case?.
I was expecting to create all users & groups on the Samba4 side for this
environment, but i got curious about your last comment on the lack of
Global Catalog. Which operations won't work?
Regards,
CI.-
On Wed, Nov 3, 2021, 11:48 Alexander Bokovoy <abokovoy(a)redhat.com> wrote:
On ke, 03 marras 2021, Cyrus via FreeIPA-users wrote:
>Good morning,
>
>I'm in the need to implement an Identity service for a mixed environment
>with Windows workstations & Linux systems with a common set of users.
>
>Would it be possible to implement Samba4 for the MS Windows realm and
>FreeIPA for the linux machines (where I expect to make use of HBAC &
>sudoers support)?.
>
>Would make sense to have all the users in Samba4 or the other way around
>(all users in FreeIPA).
Samba 4.4 or later shuold support trust to FreeIPA as a separate Active
Directory forest. Ideally, you need to use a recent Samba version, like
4.13+. From FreeIPA perspective Samba AD should look like a normal
Active Directory forest.
Since there is no support for Global Catalog on FreeIPA side yet, only
users defined in Samba AD would have access to resources on both sides.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland