On la, 23 huhti 2022, Cyrus via FreeIPA-users wrote:
Hello!,
I'm looking to deploy a multisite setup of FreeIPA, it would be 4
sites and 2 nodes per site. Alongside FreeIPA, there will also be:
- a pair of Samba4 controllers per site that I would like to setup trust with
- sites 5 & 6 from a third party running Windows 2019 AD (single
domain, DR setup), with which I also need to setup an AD trust.
Is it required that my 8 replicas establish trust with all Samba4 and
Windows 2019 servers?
You are using wrong terminology and mixing up preparation of the
replicas with actual trust agreement. Please read
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...
You do not need to establish trust again and again from different
replicas.
In short, trust between IPA and an Active Directory forest is
established once, there is no need to re-establish it multiple times
from different replicas. A replica that can establish trust is called
'Trust Controller'. A replica that can use trust to resolve users and
groups is called 'Trust Agent'. If you need to ensure that users and
groups from trusted forests can be resolved everywhere, then all those
replicas need to be trust agents. You don't need to re-establish trust
or to make all of those replicas trust controllers.
So all you need to do is:
- make at least one Trust Controller
- use a Trust Controller to designate other replicas Trust Agents
- establish trust to the Active Directory forest(s)
Then all clients connected to Trust Agents and Trust Controllers will be
able to resolve users and groups from trusted forests.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland