<div dir="ltr">Great<div><br></div><div>I basically said just advised that if they want to make all the IDM bells and whistles work with AD and Elevated access they need to move on from a 2k3 as its just not being supported upstream really. </div>
<div><br></div><div style><br></div><div>Thanks guys. <br></div><div><br></div><div style><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Jun 19, 2013 at 3:24 PM, Ana Krivokapic <span dir="ltr"><<a href="mailto:akrivoka@redhat.com" target="_blank">akrivoka@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 06/19/2013 06:47 PM, Alexander Bokovoy wrote:<br>
> On Wed, 19 Jun 2013, Dmitri Pal wrote:<br>
>> On 06/19/2013 12:35 PM, Alexander Bokovoy wrote:<br>
>>> On Wed, 19 Jun 2013, Aly Khimji wrote:<br>
>>>> So as others have mentioned windows obviously isn't my area of focus<br>
>>>> here<br>
>>>> either, however we have this working with 2003r2, but I do notice odd<br>
>>>> behaviour with "id" returning odd results sometimes depending on what<br>
>>>> system I am logged in from or initial logins failing the first time and<br>
>>>> working the second time, would this be a result of 2003 trust vs 2008<br>
>>>> trust?<br>
>>> Ok, so I have tried another time and went through Windows Server 2003 R2<br>
>>> setup again.<br>
>>><br>
>>> You need to select domain functional level Windows Server 2003 and after<br>
>>> that raise forest functional level to Windows Server 2003.<br>
>>><br>
>>> Only in this case it will work, though without AES encryption (only RC4<br>
>>> encryption is available).<br>
>>><br>
>>> See <a href="http://technet.microsoft.com/en-us/library/cc738822%28v=ws.10%29.aspx" target="_blank">http://technet.microsoft.com/en-us/library/cc738822%28v=ws.10%29.aspx</a><br>
>>> for Windows specifics.<br>
>>><br>
>>> In order to raise forest functional level one needs to open 'Active<br>
>>> Directory Domains and Trusts' snap-in and right-click on 'Active<br>
>>> Directory Domains and Trusts' root in the left pane. Then select 'Raise<br>
>>> forest functional level ...' and use "Windows Server 2003" as the level<br>
>>> to raise.<br>
>>><br>
>>> After that you can try establishing trust from IPA side.<br>
>>><br>
>>> Here is IPA behavior (the output corresponds to FreeIPA 3.2 but behavior<br>
>>> should be the same in RHEL 6.4):<br>
>>><br>
>>> # ipa trust-add ad.domain --admin Administrator --password<br>
>>> Active directory domain administrator's password: ipa: ERROR: invalid<br>
>>> 'AD domain controller': unsupported functional level<br>
>>><br>
>>> (went and raised forest functional level)<br>
>>> # ipa trust-add ad.domain --admin Administrator<br>
>>> --password<br>
>>> Active directory domain administrator's password:<br>
>>> --------------------------------------------------<br>
>>> Added Active Directory trust for realm "ad.domain"<br>
>>> --------------------------------------------------<br>
>>> Realm name: ad.domain<br>
>>> Domain NetBIOS name: ADP<br>
>>> Domain Security Identifier: S-1-5-21-426902846-1951547570-376736459<br>
>>> SID blacklist incoming: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2,<br>
>>> S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7,<br>
>>> S-1-5-8, S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12,<br>
>>> S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16,<br>
>>> S-1-5-17,<br>
>>> S-1-5-18, S-1-5-19, S-1-5-20<br>
>>> SID blacklist outgoing: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2,<br>
>>> S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7,<br>
>>> S-1-5-8, S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12,<br>
>>> S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16,<br>
>>> S-1-5-17,<br>
>>> S-1-5-18, S-1-5-19, S-1-5-20<br>
>>> Trust direction: Two-way trust<br>
>>> Trust type: Active Directory domain<br>
>>> Trust status: Established and verified<br>
>>><br>
>>><br>
>>> Note that there will be all kinds of issues due to AES encryption keys<br>
>>> are missing -- you would not be able to use IPA credentials to obtain<br>
>>> Kerberos tickets against Windows services, for example. This whole<br>
>>> experiment is rather of a limited value.<br>
>>><br>
>>> But at least, log-in with PuTTY 0.62 works.<br>
>>><br>
>><br>
>> Should we put this on wiki as a how to?<br>
> Definitely. If nobody beats me through the night, adding it to<br>
> <a href="http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup" target="_blank">http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup</a>, I'll do it<br>
> tomorrow.<br>
><br>
><br>
<br>
</div></div>The wiki page has been updated with this information.<br>
<br>
<a href="http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup#Trusts_and_Windows_Server_2003_R2" target="_blank">http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup#Trusts_and_Windows_Server_2003_R2</a><br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Regards,<br>
<br>
Ana Krivokapic<br>
Associate Software Engineer<br>
FreeIPA team<br>
Red Hat Inc.<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
_______________________________________________<br>
Freeipa-users mailing list<br>
<a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
</div></div></blockquote></div><br></div>