hi,
according to the satellite documentation (
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.4/html/...)
this should work, but it's a bit unclear as to how.
Let's see, we have a cross realm trust between an AD (2016) and RHEL 7.7. I
have an external group mapped in IdM to an AD group, I can login using ssh
with my AD user to the host running the foreman which is member of IdM (not
satellite, I know, but we require some functionality in the foreman not
available in satellite). So far so good.
But what exactly do I need to do now? According to the manual:
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.4/html/...
13.3.6. Configuring the IdM Server to Use Cross-Forest Trust
On the IdM server, configure the server to use cross-forest trust.
*Procedure*
1.
Enable HBAC:
1. Create an external group and add the AD group to it.
2. Add the new external group to a POSIX group.
3. Use the POSIX group in a HBAC rule.
2.
Configure sssd to transfer additional attributes of AD users.
-
Add the AD user attributes to the *nss* and *domain* sections in
/etc/sssd/sssd.conf.
For example:
[nss]
user_attributes=+mail, +sn, +givenname
[domain/EXAMPLE]
ldap_user_extra_attrs=mail, sn, givenname
So I have the external group mapped to a posix group, I can login with my
AD user so that takes care of 1. a) 1 b) and 1 c).
Point 2 means I need to modify sssd.conf in the foreman host, I think.
And then?
--
Groeten,
natxo