On to, 14 marras 2019, lejeczek via FreeIPA-users wrote:
hi guys
I've have AD trust work fine (gssapi), ssh & samba are password-less
when the trust is establish with 'admin' credentials.
But the strory is very different with 'shared secret'. Kerberos does not
work, passwords are asked for and with Windows cifs - asks for username
and no authentication even with passwords!
And this weird bit, I do:
$ ipa trust-add --all --two-way=0 --type=ad bec.private.mac.ac.uk
--trust-secret --server=win8-vm.bec.private.mac.ac.uk
Shared secret for the trust:
...
Here, for the 'secret' I can punch in anything and IPA will say that the
trust was added successfully - this surely must not be right, right?
So, should 'secret' work for one-way incoming trust in IPA? To me, it
does not seem like.
It very much depends what RHEL/CentOS version do you use. What
ipa-server package version? You need RHEL 7.7 as a base.
See
https://bugzilla.redhat.com/show_bug.cgi?id=1757507
However, there is a catch. If you have more than one domain in your IPA
deployment that is not subdomain of the primary IPA domain (e.g.
example.test and anotherdomain.test where example.test is primary IPA
domain), then GSSAPI authentication to anotherdomain.test would not work
from Windows machines. This is because we don't yet have implementation
of the APIs expected by Active Directory domain controllers to retrieve
the forest topology from IPA side and we cannot update it on AD DC side
from IPA without admin credentials.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland