Hello and thanks for your time,
My first approach was to create 2 trust:
ipa.mydomain.com --trust-->
mydomain.com (already DONE)
ipa.mydomain.com --trust-->
other.company.org (not possible)
When I try to do the second one, I have the error:
# ipa trust-add --type=ad
other.company.org --range-type=ipa-ad-trust --all
--external=true
Active Directory domain administrator: ad_ADMIN
Active Directory domain administrator's password:
ipa: ERROR: CIFS server communication error: code "-1073741771", message
"The object name already exists." (both may be "None")
checking on the http error log with samba debug =100, we have:
result : NT_STATUS_OBJECT_NAME_COLLISION
On AD side we have:
"a trust relationship with the domain you specified already exist"
[cid:image001.jpg@01D4B960.B4CA41E0]
That is because we already have a transitive trust between
other.company.org and
mydomain.com, so *.mydomain.com (in our case
ipa.mydomain.com) already has a trust with
other.company.org on AD side.
Then, the only way I see is using the transitivity for making users from
other.company.org, login on
ipa.mydomain.com services. Is that possible?
That's the reason because I'm thinking that "Selective authentication"
can be de problem.
Regards.
On ke, 30 tammi 2019, SOLER SANGUESA Miguel via FreeIPA-users wrote:
Hello,
I have 2 AD domains on windows 2016 with a forest trust, two-way, and
"Selective authentication":
Now I have built an IDM instance on RHEL 7.5 and IPA version 4.5.4 on
the subdomain "ipa.mydomain.com". I need to use users from
the 2
domains above, to I have created a trust transitive and one way:
But I can not do the trust between
ipa.mydomain.com <--
other.company.org because on AD side there is already a trust between
other.company.org and the root of ipa (
mydomain.com). As the trust is
transitive, in theory users from
other.company.org should be allowed
on
ipa subdomain because:
This is working as designed.
I can get a kerberos TGT with: "kinit
user@OTHER.COMPANY.ORG<mailto:user@OTHER.COMPANY.ORG>"
But I can not do "id
user@other.company.org<mailto:user@other.company.org>" neither I can add it to
an external group, it complains: member group:
user@other.company.org<mailto:user@other.company.org>:
invalid 'trusted domain object': domain is not trusted"
Should I change something on the sssd or kerberos configuration for
make the users trusted by my trust work? Is the "Selective
authentication" configured at AD level the problem?
You have to configure separate forest trusts to both
mydomain.com and
other.company.org
from IPA side. There is no way around it. Selective authentication only affects forest
trust link between the two forests.
This is a fundamental design decision in Active Directory architecture, nothing specific
to FreeIPA.
See section 'Forest trusts' in the following document:
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows...
------
A forest trust can be created only between a forest root domain in one Windows Server 2003
forest and a forest root domain in another Windows Server 2003 forest. Forest trusts can
be created between two forests only and cannot be implicitly extended to a third forest.
This means that if a forest trust is created between Forest 1 and Forest 2, and another
forest trust is created between Forest 2 and Forest 3, Forest 1 does not have an implicit
trust with Forest 3.
------
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering Red Hat Limited, Finland