On 16/01/2019 21:17, Alexander Bokovoy wrote:
On ke, 16 tammi 2019, lejeczek via FreeIPA-users wrote:
> hi guys
>
> After a longer break from Windowze, I had Win2012 trust okey in the
> past, now I'm fiddling with Win2016 and have this question:
>
> After trust (one-way coming from AD) established okey should AD's
> users be immediately available to/in IPA?
>
> Usual things such as id, ipa user-show do find them users. I cannot
> remember how it was with my Win2012.
There should be no difference in functional behavior.
Perhaps, you were lucky in terms of establishing trust at a time when
SSSD on IPA master decided to refresh its domain information and
discovering it has new trusted domains to look at.
Do we users/admins have any/some control over those bits, over how SSSD
refreshes & caches this bits?
I've decided to briefly try with 2016 "lab" type, my own 2016 I control.
I get users immediately with one-way (full credentials and no shared
secret) trust but only on the master which established the trust,
remaining master though they can validate the trust with kvno/kinit they
at the moment see no AD users with id/getent/ipa user.
Reading docs I could not get this clarified, I suppose but having this
crystal clear would be best - ipa-adtrust-install is only needed on that
one master which will establish the trust and does need to be on each
IPA's master?