We use an IPA domain for a large part of our internal servers.
Our first one-way trust implementation was not properly working because of
Two-way trust in our environment is not possible, because normal users are
(we can resolve 'system/service' accounts without those limitations)
After finding out about this limitation, we did again configure one-way
This time, we found about the registry / GPO solution to direct windows
clients to the IPA KDC's.
And all is working properly...
Last week we received a request from an external company that wants AD
They will manage their own set of RHEL servers for a specific project.
I proposed they can use the IDM domain for feature-full integration with
the AD domain.
But.... there is some discussion going on.... our AD architect(s) calls the
IPA integration with AD lacking.
Their opinion is that windows clients should discover automatically when
they need a IPA KDC
Also, they find it a severe issue that everything is hidden after one SID
(which is given permissions with the correct search scope)
As such they can' t see/discover anything in the IPA domain (logically...)
So the Windows / AD guys propose a direct integration using a keytab -
without thinking about the requirements, and comparing with network devices
I am not talking about realmd.
What is the up-to-date opinion on SSSD realmd integration versus IDM
integration? Or other options?
What will the external company be losing in features?
And which has most risks?
But most of all: what can we do to make IPA domain<-> AD domain integration