I am working on a team to plan a migration to IPA on our UNIX based systems. One thing I was seeking information on is Computer groups. If a trust is established with our campus AD infrasturcture, will its computer groups be shared with IPA or just users? If computer groups are transferred to host groups this will make managing permissions easier without having to recreate all the groups on the IPA side I could not find any info in this document <a href=http://www.freeipa.org/page/IPAv3_testing_AD_trust>http://www.freeipa.org/page/IPAv3_testing_AD_trust</a>. If someone could point me to some documentation about the subject it would be really helpful. Thank You, Rashard Kelly Senior Linux Specialist From: Martin Kosek <mkosek@redhat.com> To: Sumit Bose <sbose@redhat.com> Cc: freeipa-users@redhat.com Date: 05/31/2013 06:41 AM Subject: Re: [Freeipa-users] IPA & AD trust question Sent by: freeipa-users-bounces@redhat.com <hr noshade> <tt>On 05/31/2013 09:37 AM, Sumit Bose wrote: > On Fri, May 31, 2013 at 06:52:27AM +0000, Ondrej Valousek wrote: >> Hi List, >> >> I have a question - is it possible to use AD trust the way that: >> 1. All users are stored in AD >> 2. All Unix specific information (automount maps, sudo rules, HBAC rules) are stored in IPA? > > Yes, sudo and HBAC for sure, I haven't tested automount maps but so far > I can see no issues. > >> >> If yes then: >> 1. Will this scenario honour the RFC2307 user attributes in AD? > > We are trying to support RFC2307 attributes in AD with the next releases > for SSSD and FreeIPA. Currently only algorithmic IP mapping based on the > AD user's RID is available. Ondreji, this is by the way the upstream ticket under which this feature is being implemented (in case you want to follow it): </tt><a href=https://fedorahosted.org/freeipa/ticket/2904><tt>https://fedorahosted.org/freeipa/ticket/2904</tt></a><tt> There are other tickets targeted on AD cooperation in FreeIPA 3.3 release (</tt><a href=https://fedorahosted.org/freeipa/report/3><tt>https://fedorahosted.org/freeipa/report/3</tt></a><tt>), you may also want to check that they address your needs (and provide comments if they don't). We are still in a design phase, so some amendments are possible. Thanks, Martin _______________________________________________ Freeipa-users mailing list Freeipa-users@redhat.com </tt><a href="https://www.redhat.com/mailman/listinfo/freeipa-users"><tt>https://www.redhat.com/mailman/listinfo/freeipa-users</tt></a><tt> </tt> See you at the 2013 Air Transport IT Summit, Brussels, 18-20 June. <a href='http://www.sita.aero/microsites/air-transport-it-summit-2013/registration'>Click here to register</a> This document is strictly confidential and intended only for use by the addressee unless otherwise stated. If you are not the intended recipient, please notify the sender immediately and delete it from your system.