OK, I do not know a lot about AIX, but I would suggest you look into
freeIPAs schema compatibility plugin.
If that is enabled and you answer yes to:
"Do you want to enable support for trusted domains in Schema Compatibility
plugin?
This will allow clients older than SSSD 1.9 and non-Linux clients to work
with trusted users.
Enable trusted domains support in slapi-nis?"
When running: ipa-adtrust-install on ipa servers
Then AD users can be found with an ldap search from
"cn=users,cn=compat,dc=your,dc=domain,dc=com".
However the LDAP schema will be RFC 2307 instead of RFC 2307bis.
Kontakt Jim Kinney via FreeIPA-users (<freeipa-users(a)lists.fedorahosted.org>)
kirjutas kuupäeval E, 14. veebruar 2022 kell 15:11:
"Trusted AD Domain". That's dubious line at best :-)
I've not seen AIX use AD for user auth but I know AD will work for Linux
systems.
HOWEVER - The AD admins must add the Linux domain as trusted so it can
exchange the encrypted data stream. Alternatively, there's a way to do this
without the Linux system having trust in the AD realm. Something to do with
not usng TLS.
The RHEL docs on user auth are pretty good for this.
You could try to set up a FreeIPA instance that is in the AD realm and
provides auth for AIX. Not sure if AIX has a sssd-ipa package or not. SLES
has sssd-ipa but doen't have freeipa server so server runs on RHEL.
On Mon, Feb 14, 2022, 1:54 AM Ronald Wimmer via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
> I was wondering if one can configure AIX in a way that trusted AD domain
> users can be used to log in under AIX. We followed
>
https://www.freeipa.org/page/ConfiguringUnixClients but this guide seems
> to be LDAP-only and AD users do not have a represenntation in FreeIPA's
> LDAP directory.
>
> Could someone please clarify if AD users could work or not?
>
> Cheers,
> Ronald
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
>
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> Do not reply to spam on the list, report it:
>
https://pagure.io/fedora-infrastructure
>
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure