Hopefully this might be a straightforward question.
I have testing instance of FreeIPA version 4.6.4 installed on CentOS 7 from the
distro's default repos. I have it configured for a one-way trust to an Active
Directory deployment. On the client side, I have installed and configured the
freeipa-client package version 4.7.0 on Ubuntu 18.04. This is all basically working as
advertised according to the docs.
However, when I log into the client with an AD account and run the `id` command, I'm
seeing all of my AD groups listed. Is there a way to have FreeIPA completely ignore all
groups from AD when dealing with external users? The ultimate goal (and let me know if
this is beyond FreeIPA's capabiltiies) is to ignore/discard all groups in AD and
manage users instead by groups in FreeIPA.
One thing I did try was adding these options to the domain section of `sssd.conf` on the
FreeIPA server, but they didn't have any effect and I suspect I don't fully
understand what they are for:
ignore_group_members = True
subdomain_inherit = ignore_group_members
Thanks for any advice, even if it's "hey, don't do that".
Show replies by date