On ma, 10 heinä 2017, None via FreeIPA-users wrote:
Hi everyone,
first post, hope the question is not too dumb and this is the right list.
I’m trying to use IPA in the way the RHEL Windows Integration Guide
describes it in the one-way-trust setup (indirect integration, using AD
for auth, IPA for policies). However, I’m hitting a wall since at one
point you have to provide AD Admin credentials (setting up the
agreement) which I don’t have/won’t have.
To establish cross-forest trust, you have
to be a member of Domain
Admins group of a forest root domain in AD or a member of an Enterprise
Admins group in the forest. There is no other way.
Question: Are there other ways to get the (almost) same result w/o
having admin access to AD?
* Some 2 years back Dmitri Dal made a comment here which seems to point into that
direction
https://pagure.io/freeipa/issue/4546
but I wasn’t able to find anything in the official documentation or elsewhere and that
issue has been closed as fixed.
No, Dmitri was wrong in his first comment. What the
ticket #4546
describes is a real one-way cross-forest trust like AD expects it.
As of now I only see recreating all the users/groups from AD in IPA w/o
any connectivity in between as one option, which would be ok but not
very elegant and users have to deal with another password.
Is it possible to use SSSD with AD as auth/idprovider and IPA for
policies (something like shown in the modern integration option image
here but with policies fetched from IPA:
http://rhelblog.redhat.com/2015/02/04/overview-of-direct-integration-opti... If
you have no credentials to establish cross-forest trust, you are not
dealing with the cross-forest trust and thus everything about trust from
RHEL Windows Integration Guide does not apply there. Yes, you can take
on a journey to hack up something based on direct integration but this
is not going to be supported in FreeIPA.
--
/ Alexander Bokovoy