On 17/01/2019 11:43, Alexander Bokovoy wrote:
On to, 17 tammi 2019, lejeczek via FreeIPA-users wrote:
> On 16/01/2019 19:26, John Keates wrote:
>> There is no enumeration support, but if you want to figure out if
>> your connection works, try getent on a group or user (or using id on
>> a group or user). If those don’t work the AD Trust might not be
>> working correctly.
>> I start the trusts on the IPA side and use Domain Admin creds (and
>> not a secret or token), that always works for me.
>>
>> If the trust works but something else is wrong, you can check if the
>> trusts are listed and domains can be fetched from the trust. If you
>> don’t even have those, the trust doesn’t work at all. If do you have
>> those it’s a different problem.
>>
>> Does the trust show on the DC in the trust settings?
>
> Trust does show in 2016 DC but because it was started there, that
> trust was set up with a shared secret on 2016 and then finished off
> on IPAs.
Ah. One-way trust with a shared secret is not supported yet. I need to
merge my patches, hopefully, somewhere after devconf/FOSDEM. It requires
changes to Samba (released in 4.7.11+, 4.8.6+), to SSSD (released in
1.16.3+), and to FreeIPA (not merged yet).
> The thing is - I do not have(and cannot have) admin
> access/credentials on 2016 AD and in such cases I understand, only
> shared key is the option available. Or nor not?
I have Windows Server 2016 deployment and I have access to admin creds
there without any problems. Unless you are trying to say that your
administrators don't like to give you temporary membership in a 'Domain
How temporary would that have to be?
Is it just for them time when IPA adds a trust and such admin access can
be removed right after that?
What when one needs to add a controller at later time, and related stuff?
Admins' group in the forest root domain or in 'Enterprise
Admins' group
to allow creating a forest trust, you should definitely be able to use
admin credentials to establish trust. Windows Server 2016 is no
different from 2012 in this sense.