On ke, 03 marras 2021, Cyrus wrote:
Thanks for the feedback Alexander. How would things like HBAC by group
work
In that case?.
Everything that is supported for trust to Active Directory will work
with Samba AD as well. Please consult RHEL IdM documentation for
details, there should be not much difference, mostly you are responsible
on setting up Samba AD yourself.
I was expecting to create all users & groups on the Samba4 side
for this
environment, but i got curious about your last comment on the lack of
Global Catalog. Which operations won't work?
The same which do not work and not supported right now against
Microsoft's AD. You would not be able to login to Windows machines with
FreeIPA users, not being able to resolve FreeIPA users and groups in
Windows UI when trying to assign permissions and so on.
Regards,
CI.-
On Wed, Nov 3, 2021, 11:48 Alexander Bokovoy <abokovoy(a)redhat.com> wrote:
> On ke, 03 marras 2021, Cyrus via FreeIPA-users wrote:
> >Good morning,
> >
> >I'm in the need to implement an Identity service for a mixed environment
> >with Windows workstations & Linux systems with a common set of users.
> >
> >Would it be possible to implement Samba4 for the MS Windows realm and
> >FreeIPA for the linux machines (where I expect to make use of HBAC &
> >sudoers support)?.
> >
> >Would make sense to have all the users in Samba4 or the other way around
> >(all users in FreeIPA).
>
> Samba 4.4 or later shuold support trust to FreeIPA as a separate Active
> Directory forest. Ideally, you need to use a recent Samba version, like
> 4.13+. From FreeIPA perspective Samba AD should look like a normal
> Active Directory forest.
>
> Since there is no support for Global Catalog on FreeIPA side yet, only
> users defined in Samba AD would have access to resources on both sides.
>
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland