Hi. Is possible set Outbound one-way only trust? Currently I can set only bidirectional or Inbound one way.
On su, 03 loka 2021, Jakub Novak via FreeIPA-users wrote:
Hi. Is possible set Outbound one-way only trust? Currently I can set only bidirectional or Inbound one way.
What is a use case? Right now FreeIPA does not provide any means for AD DCs to resolve users and groups in IPA so outbound trust is useless for the purpose of being able to login to resources in a trusting forest.
Existing two-way trust support is mostly to allow S4U extensions to work across the trust for users from a trusted forest because that is required for applications like SQL Server running on an IPA client.
Our use case is as follows: In our company, we have 80% of our computers running Linux. That's some 500 computers. The other 20% are Windows 7 to Windows 10 computers.
We use FreeIPA as the main source of user accounts. So we have set up Active Directory on the second server, to log users into Windows, and we need them to be able to log into the Windows systems using IPA credentials.
Two-way sync works fine, but for this reason we would need Outbound one-way sync.
So we need to authenticate the user credentials to the FreeIPA server. We don't need the reverse way - we don't want to authenticate users in AD
On su, 03 loka 2021, Jakub Novak via FreeIPA-users wrote:
Our use case is as follows: In our company, we have 80% of our computers running Linux. That's some 500 computers. The other 20% are Windows 7 to Windows 10 computers.
We use FreeIPA as the main source of user accounts. So we have set up Active Directory on the second server, to log users into Windows, and we need them to be able to log into the Windows systems using IPA credentials.
As I said, this is not supported right now.
freeipa-users@lists.fedorahosted.org
-
Alexander Bokovoy -
Jakub Novak