On to, 17 tammi 2019, lejeczek via FreeIPA-users wrote:
On 16/01/2019 19:26, John Keates wrote:
>There is no enumeration support, but if you want to figure out if your connection
works, try getent on a group or user (or using id on a group or user). If those don’t work
the AD Trust might not be working correctly.
>I start the trusts on the IPA side and use Domain Admin creds (and not a secret or
token), that always works for me.
>
>If the trust works but something else is wrong, you can check if the trusts are listed
and domains can be fetched from the trust. If you don’t even have those, the trust doesn’t
work at all. If do you have those it’s a different problem.
>
>Does the trust show on the DC in the trust settings?
Trust does show in 2016 DC but because it was started there, that
trust was set up with a shared secret on 2016 and then finished off on
IPAs.
Ah. One-way trust with a shared secret is not supported yet. I need to
merge my patches, hopefully, somewhere after devconf/FOSDEM. It requires
changes to Samba (released in 4.7.11+, 4.8.6+), to SSSD (released in
1.16.3+), and to FreeIPA (not merged yet).
The thing is - I do not have(and cannot have) admin access/credentials
on 2016 AD and in such cases I understand, only shared key is the
option available. Or nor not?
I have Windows Server 2016 deployment and I have
access to admin creds
there without any problems. Unless you are trying to say that your
administrators don't like to give you temporary membership in a 'Domain
Admins' group in the forest root domain or in 'Enterprise Admins' group
to allow creating a forest trust, you should definitely be able to use
admin credentials to establish trust. Windows Server 2016 is no
different from 2012 in this sense.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland