Yes, it is possible to do so. It will require you to turn on
the compatibility tree and point to do that dn. More than likely you'll
need to run `ipa-adtrust-install --enable-compat` on all IPA servers
that are trust controllers/agents. Once you do so, you'll get a
cn=compat,... you can use.
Users:
cn=users,cn=compat,dc=ipa,dc=example,dc=com
Groups:
cn=groups,cn=compat,dc=ipa,dc=example,dc=com
What will happen is
all IPA users and groups typically show up immediately. But the AD
users/groups will not until there is a query for them (eg ldapsearch or
bind attempt), which should be sufficient. In my previous cases of using
the compat tree, it was for Solaris, FreeBSD, and RHEL 5, and I didn't
run into too many issues.
Dumb question
...
For use cases (temporary/ephemeral/auto-scaling servers) where we
can't
do a full ipa-client-install on a managed node is it possible to use the
LDAP service on FreeIPA to check a username and password for an AD-trust
user?
I've been fooling around with making AWS Parallelcluster nodes LDAP
clients of a FreeIPA environment and it actually works really well with
users and groups that are local to FreeIPA; it's quite a nice solution
actually and solves a consistency problem for some users and groups we
need to persist as HPC grids are launched and destroyed.
Was wondering idly if the LDAP service extended to being able to
authenticate a user that exists within an AD-trust. It does not seem to
work out of the box but I was wondering if a change of the LDAP bind DN
or other settings would allow this to work?
Wanted to ask if this was even possible before I spent more time
working
on my ldap configs!
Regards
Chris