On Fri, Jun 28, 2013 at 06:43:48PM +0200, Jakub Hrozek wrote:
Hi,
the attached patches implement
https://fedorahosted.org/sssd/ticket/1962. When a new option,
ipa_server_mode is set to True, then subdomain/trusted users are not
looked up using the extop plugin but AD ID context is initialized and
the users are looked up directly with AD code. This is in support of
legacy clients looking up trusted AD users and groups.
I forgot to add that until FreeIPA gains the ability to attach PAC to
the TGT you obtain you need to use a keytab from AD to auth with AD.
Attached is a simple patch (just for demo purposes) that I used during
my testing.