On su, 17 marras 2019, lejeczek via FreeIPA-users wrote:
On 14/11/2019 11:44, Alexander Bokovoy wrote:
> On to, 14 marras 2019, lejeczek via FreeIPA-users wrote:
>> hi guys
>>
>> I've have AD trust work fine (gssapi), ssh & samba are
>> password-less
>> when the trust is establish with 'admin' credentials.
>>
>> But the strory is very different with 'shared secret'.
>> Kerberos does not
>> work, passwords are asked for and with Windows cifs -
>> asks for username
>> and no authentication even with passwords!
>>
>> And this weird bit, I do:
>>
>> $ ipa trust-add --all --two-way=0 --type=ad
>> bec.private.mac.ac.uk
>> --trust-secret --server=win8-vm.bec.private.mac.ac.uk
>>
>> Shared secret for the trust:
>>
>> ...
>>
>> Here, for the 'secret' I can punch in anything and IPA
>> will say that the
>> trust was added successfully - this surely must not be
>> right, right?
>>
>> So, should 'secret' work for one-way incoming trust in
>> IPA? To me, it
>> does not seem like.
>
> It very much depends what RHEL/CentOS version do you use.
> What
> ipa-server package version? You need RHEL 7.7 as a base.
>
I do not think this works. I've been now trying 4.7.1 on
Centos 8 and I get the same results which are - no kerberos
for user authentication.
Which is even more disappointing when you check rpm
changelogs for both versions because there it says that it's
been implemented.
It works and we have tests for it, all commits are in
https://pagure.io/freeipa/issue/6077
If it doesn't work for you, you need to follow
https://access.redhat.com/solutions/3346421 to gather logs and provide
them off-list.
I'm on vacation until November 26th and most likely will have no access
to my work email.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland