We are running IPA ver 4.9.11

We are trying to integrate our storage system (from a large, well known vendor who shall be nameless) with our existing AD/IPA setup. We presently have a one way trust established with AD and it's working well. All of our user objects are in AD.

We need the ability have synchronized UID/GID across all systems so that permissions do not cause issues or problems for our users. We'd like to know if creating a two way trust could enable IPA to write back UID/GID attributes to AD?

We also know another approach is to create POSIX attributes in AD for every user and establish an AD trust with POSIX attributes. We also have a few other options to make this work but wanted to exhaust any possibilities within IPA first as they would be the easiest to implement.

Thanks for feedback!