<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I’ve got a prototype setup for cross-realm operations. I don’t know if that’s useful for you or not. I don’t have control over “my” AD, and I’m managing this during our CIO’s migration from one AD realm to another (so duplicate users having distinct DNs and Kerberos principals are the norm, rather than the exception). I have three upstreams: FreeIPA, and Corporate AD A and B.<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">My non-FreeIPA users setup is in two stages, meaning two separate OpenLDAP servers. I couldn’t squash them down onto one server, but you might be smarter than me:<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">1] A “remapping” metadirectory server, which combines all of the foreign users from all three upstreams into one DIT (although each upstream gets its own OU). This server’s job is to make sure that a single LDAP query can return results from any of the upstream servers. It stores nothing locally and masks out most of the upstream info. LDAP binds are passed thru to upstream.<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">2] A “translucent proxy” server, which does no remapping, but lets me add/override attributes. Also have RFC2307 group stored here.<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">FWIW, I don’t have a trust between any AD and FreeIPA. The metadirectory server binds as me against AD (via a keytab and k5start). You can get pretty far without a trust, and without the ability to create groups on the AD side.<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">My goal is to set myself up to take advantage of “views” when they make it into FreeIPA. The real objective, though, is to propagate the cross realm functionality enjoyed for the last four years with my ldap/padl setup into a freeipa/sssd environment. Long term, I want FreeIPA to internalize my sketchy prototype setup and manage uid/uidNumber/gidNumber/loginShell/homeDirectory overrides for my linux domain in some sensible and convenient way.<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I’m trying to implement the “umich_schema” (man idmapd.conf) to enable cross realm NFS, eventually, if I ever get a trust. Ideally, this could also be used by sssd to map GSSAuthName to username, particularly if a person has more than one GSSAuthName.<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Dumb and persistent sometimes trumps smart. </span><span style="font-size:11.0pt;font-family:Wingdings;color:#1F497D">J</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"> <o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Bryce<o:p></o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p> <div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt"> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> <p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> freeipa-users-bounces@redhat.com [mailto:freeipa-users-bounces@redhat.com] <b>On Behalf Of </b>Daniel Shown<br> <b>Sent:</b> Monday, August 11, 2014 3:04 PM<br> <b>To:</b> Alexander Bokovoy<br> <b>Cc:</b> freeipa-users<br> <b>Subject:</b> Re: [Freeipa-users] about AD trusts and passthrough authentication<o:p></o:p></span></p> </div> </div> <p class="MsoNormal"><o:p> </o:p></p> <div> <p class="MsoNormal">Right, that's what I've got at this point. I just wanted to make sure I wasn't missing something. Unfortunately, that architecture won't work for me (mostly for political reasons instead of technical ones). I guess I'll be digging into pass through auth to see if I can get that working.<o:p></o:p></p> <div> <p class="MsoNormal"><o:p> </o:p></p> </div> <div> <p class="MsoNormal">thx.<o:p></o:p></p> </div> </div> <div> <p class="MsoNormal"><br clear="all"> <o:p></o:p></p> <div> <div> <p class="MsoNormal">===================================<o:p></o:p></p> <div style="margin-left:30.0pt"> <p class="MsoNormal"><b><span style="font-family:"Arial","sans-serif"">Daniel Shown,</span></b><span style="font-family:"Arial","sans-serif""><br> </span>Linux Systems Administrator<span style="font-family:"Arial","sans-serif""><br> Advanced Technology Group<br> </span><a href="http://www.slu.edu/its" target="_blank"><span style="font-family:"Arial","sans-serif"">Information Technology Services</span></a><span style="font-family:"Arial","sans-serif""><br> at </span><a href="http://www.slu.edu/" target="_blank"><span style="font-family:"Arial","sans-serif"">Saint Louis University</span></a><span style="font-family:"Arial","sans-serif"">.<br> <br> </span>314-977-2583<o:p></o:p></p> </div> <p class="MsoNormal" style="margin-bottom:12.0pt">===================================<o:p></o:p></p> <div style="margin-left:30.0pt"> <p class="MsoNormal">"The aim of education <br> is the knowledge, <br> not of facts, <br> but of values." <br> — William S. Burroughs<br> <br> "I’m supposed to be <o:p></o:p></p> </div> <div style="margin-left:30.0pt"> <p class="MsoNormal">a scientific person <o:p></o:p></p> </div> <div style="margin-left:30.0pt"> <p class="MsoNormal">but I use intuition <o:p></o:p></p> </div> <div style="margin-left:30.0pt"> <p class="MsoNormal">more than logic <o:p></o:p></p> </div> <div style="margin-left:30.0pt"> <p class="MsoNormal">in making basic <o:p></o:p></p> </div> <div style="margin-left:30.0pt"> <p class="MsoNormal">decisions."<o:p></o:p></p> </div> <div style="margin-left:30.0pt"> <p class="MsoNormal">— Seymour R. Cray<o:p></o:p></p> </div> <div style="margin-left:30.0pt"> <p class="MsoNormal"><o:p> </o:p></p> </div> <p class="MsoNormal"><span style="border:solid windowtext 1.0pt;padding:0in"><img border="0" width="420" height="21" id="_x0000_i1025" src="cid:image001.jpg@01CFB577.08C09C10" alt="Image removed by sender."></span><o:p></o:p></p> </div> </div> <p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p> <div> <p class="MsoNormal">On Mon, Aug 11, 2014 at 3:08 PM, Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>> wrote:<o:p></o:p></p> <div> <p class="MsoNormal">On Mon, 11 Aug 2014, Daniel Shown wrote:<o:p></o:p></p> <p class="MsoNormal">I'm fairly new to FreeIPA, so can someone give me a sanity check? Should I<br> be able to map AD users in an AD trust to to corresponding FreeIPA users?<br> i.e. Users can auth with their AD credentials and get a FreeIPA uidnumber,<br> gidnumber, home, etc.?<o:p></o:p></p> </div> <p class="MsoNormal">Users from a trusted forest are treated as separate users. They have<br> their own identities and get IDs from either Active Directory (if POSIX<br> compatibility is enabled at AD) or from special ID range allocated for<br> them in IPA.<br> <br> You can include these users (and groups, it doesn't matter what is what)<br> into special type of groups in IPA, called "external" groups. These<br> groups, in turn, can be members of existing POSIX groups from IPA. If<br> done so, your AD users will become members of appropriate POSIX groups<br> from IPA by means of nested membership.<br> <br> These POSIX groups then can be used to apply SUDO or HBAC rules against<br> AD users.<span style="color:#888888"><br> <br> <span class="hoenzb">-- </span><br> <span class="hoenzb">/ Alexander Bokovoy</span></span><o:p></o:p></p> </div> <p class="MsoNormal"><o:p> </o:p></p> </div> </div> </div> <br> <br> <br> <br> This electronic message contains information generated by the USDA solely for the intended recipients. Any unauthorized interception of this message or the use or disclosure of the information it contains may violate the law and subject the violator to civil or criminal penalties. If you believe you have received this message in error, please notify the sender and delete the email immediately. </body> </html>