<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> On 05/31/2013 08:39 AM, <a class="moz-txt-link-abbreviated" href="mailto:Rashard.Kelly@sita.aero">Rashard.Kelly@sita.aero</a> wrote: <blockquote cite="mid:OFFA1013BF.549B6213-ON85257B7C.0044F5A5-85257B7C.00458340@sita.aero" type="cite">I am working on a team to plan a migration to IPA on our UNIX based systems. One thing I was seeking information on is Computer groups. If a trust is established with our campus AD infrasturcture, will its computer groups be shared with IPA or just users? If computer groups are transferred to host groups this will make managing permissions easier without having to recreate all the groups on the IPA side I could not find any info in this document <a moz-do-not-send="true" href="http://www.freeipa.org/page/IPAv3_testing_AD_trust">http://www.freeipa.org/page/IPAv3_testing_AD_trust</a>. If someone could point me to some documentation about the subject it would be really helpful. </blockquote> IPA does not share or transfer host groups from AD and it is conceptually does not make sense since. The systems managed by AD and the systems managed by IPA are in our view completely no overlapping sets of systems. Can you please share your reasoning why it is something that makes sense to have? So far our view of the world was that AD manages Windows systems and groupings and polices around those while IPA does the same for Linux systems. <blockquote cite="mid:OFFA1013BF.549B6213-ON85257B7C.0044F5A5-85257B7C.00458340@sita.aero" type="cite"> Thank You, Rashard Kelly Senior Linux Specialist From: Martin Kosek <a class="moz-txt-link-rfc2396E" href="mailto:mkosek@redhat.com"><mkosek@redhat.com></a> To: Sumit Bose <a class="moz-txt-link-rfc2396E" href="mailto:sbose@redhat.com"><sbose@redhat.com></a> Cc: <a class="moz-txt-link-abbreviated" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Date: 05/31/2013 06:41 AM Subject: Re: [Freeipa-users] IPA & AD trust question Sent by: <a class="moz-txt-link-abbreviated" href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a> <hr noshade="noshade"> <tt>On 05/31/2013 09:37 AM, Sumit Bose wrote: > On Fri, May 31, 2013 at 06:52:27AM +0000, Ondrej Valousek wrote: >> Hi List, >> >> I have a question - is it possible to use AD trust the way that: >> 1. All users are stored in AD >> 2. All Unix specific information (automount maps, sudo rules, HBAC rules) are stored in IPA? > > Yes, sudo and HBAC for sure, I haven't tested automount maps but so far > I can see no issues. > >> >> If yes then: >> 1. Will this scenario honour the RFC2307 user attributes in AD? > > We are trying to support RFC2307 attributes in AD with the next releases > for SSSD and FreeIPA. Currently only algorithmic IP mapping based on the > AD user's RID is available. Ondreji, this is by the way the upstream ticket under which this feature is being implemented (in case you want to follow it): </tt><a moz-do-not-send="true" href="https://fedorahosted.org/freeipa/ticket/2904"><tt>https://fedorahosted.org/freeipa/ticket/2904</tt></a><tt> There are other tickets targeted on AD cooperation in FreeIPA 3.3 release (</tt><a moz-do-not-send="true" href="https://fedorahosted.org/freeipa/report/3"><tt>https://fedorahosted.org/freeipa/report/3</tt></a><tt>), you may also want to check that they address your needs (and provide comments if they don't). We are still in a design phase, so some amendments are possible. Thanks, Martin _______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> </tt><a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/freeipa-users"><tt>https://www.redhat.com/mailman/listinfo/freeipa-users</tt></a><tt> </tt> See you at the 2013 Air Transport IT Summit, Brussels, 18-20 June. <a moz-do-not-send="true" href="http://www.sita.aero/microsites/air-transport-it-summit-2013/registration">Click here to register</a> This document is strictly confidential and intended only for use by the addressee unless otherwise stated. If you are not the intended recipient, please notify the sender immediately and delete it from your system. <fieldset class="mimeAttachmentHeader"></fieldset> <pre wrap="">_______________________________________________ Freeipa-users mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager for IdM portfolio Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> </pre> </body> </html>