<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 12/10/2013 11:20 AM, Alfredo Vazquez wrote:
<blockquote
cite="mid:CAExt9ri4-fCgO0zns9=BT9k0Dg6F1+GTEscQ=LuAf7+ywCC1Ew@mail.gmail.com"
type="cite">
<div dir="ltr"><span id="result_box" class="" lang="en"><span
class="">Hi Everyone,</span> <span class="">my question</span>
<span class="">is as follows</span><span>:</span><br>
<span class="">As</span> <span class="">Ipa</span> <span
class="">authenticate</span> <span class="">a</span> <span
class="">server to a</span> <span class="">Windows 7</span>
<span class="">client so that the</span> <span class="">login</span>
<span class="">is correct</span><span>, I hope</span> <span
class="">your help</span><br>
</span></div>
</blockquote>
<br>
So you are saying that you want the IPA users connecting via Windows
7 clients be able to access servers in AD domain?<br>
As it was explained below it is yet not possible.<br>
<br>
<blockquote
cite="mid:CAExt9ri4-fCgO0zns9=BT9k0Dg6F1+GTEscQ=LuAf7+ywCC1Ew@mail.gmail.com"
type="cite">
<div dir="ltr"><span id="result_box" class="" lang="en">
<br>
<span class="">GREETINGS</span></span></div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">2013/12/10 Martin Kosek <span
dir="ltr"><<a moz-do-not-send="true"
href="mailto:mkosek@redhat.com" target="_blank">mkosek@redhat.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 12/09/2013 11:34 PM, Alexander Bokovoy
wrote:<br>
> On Mon, 09 Dec 2013, Johan Petersson wrote:<br>
>> Hi,<br>
>><br>
>> In my test environment i am planning to add a AD
to my current IPA<br>
>> configuration and i would like my IPA users to be
able to log in<br>
>> through windows to the AD and still have their
IPA shared home<br>
>> directory.<br>
>><br>
>> IPA is Red Hat 6.5 and AD is Windows 2012 Server.<br>
>><br>
>> Home Directories are currently shared through NFS
and Kerberos<br>
>><br>
>> Is there a preferred way to connect the AD to IPA
for this<br>
>> functionality?<br>
> Using IPA identities to log-in to Windows machines is
not implemented<br>
> yet.<br>
<br>
</div>
Hello Johan,<br>
<br>
I would like to elaborate more on this topic. What is
currently already working<br>
and supported is the AD->IPA authentication. You can SSO
from Windows to Linux<br>
machine controlled by FreeIPA already.<br>
<br>
The second part (IPA->AD) is much more complicated, it
requires additional<br>
MS-specific interfaces implemented on IPA side. This is a
feature we are<br>
working on in FreeIPA 3.4 (i.e. the next version). We would
like to publish a<br>
working version (at least PoC) when it is released.<br>
<br>
This is the upstream ticket tracking the effort:<br>
<a moz-do-not-send="true"
href="https://fedorahosted.org/freeipa/ticket/2586"
target="_blank">https://fedorahosted.org/freeipa/ticket/2586</a><br>
<br>
This is the related information on our community wiki:<br>
<a moz-do-not-send="true"
href="http://www.freeipa.org/page/Trusts" target="_blank">http://www.freeipa.org/page/Trusts</a><br>
<a moz-do-not-send="true"
href="http://www.freeipa.org/page/V3/Trust_GC_support"
target="_blank">http://www.freeipa.org/page/V3/Trust_GC_support</a><br>
<br>
HTH,<br>
Martin<br>
<div class="HOEnZb">
<div class="h5"><br>
_______________________________________________<br>
Freeipa-users mailing list<br>
<a moz-do-not-send="true"
href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br>
<a moz-do-not-send="true"
href="https://www.redhat.com/mailman/listinfo/freeipa-users"
target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
</div>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
<img moz-do-not-send="true"
src="http://dl.dropbox.com/u/108608187/Firma_AVM_2012.jpg"><br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Freeipa-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>