<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 01/31/2015 01:37 PM, Genadi
Postrilko wrote:<br>
</div>
<blockquote
cite="mid:CAPP+0vKsMhmLHcMaKSn6FQ7hKnyvyPPnNhhNy=azDvAL+YAoGw@mail.gmail.com"
type="cite">
<div dir="rtl">
<div dir="ltr">Hello all.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">The environment i'm currently working to migrate
under IPA identity management contains mostly RHEL 6.2
servers. </div>
<div dir="ltr">I'm planing to use Active Directory Cross Forest
Trust for Identities, IPA as sudo provider, and all the other
goodies that IPA provides.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">If i want to enjoy all the new features (at least
most of them), i know that clients have to be sssd version
> 1.9. And if i want IPA to be auto configured as sudo
provider it has to be sssd > 1.11.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">When reading the mailing list i noticed that sssd
1.11 is mentioned as feature of rhel 6.6.</div>
<div dir="ltr">What i would like and understand is what could go
wrong if i will install sssd 1.11 on rhel 6.2 servers.And what
is is your general recommendations for older RHEL 6 (minor)
releases?</div>
</div>
</blockquote>
<br>
It will pull a lot of dependencies and most of your system will look
like 6.6 system<br>
Also the upgrade like this might reveal some issues as the upgrades
are expected to be gradual. 1-2 versions is ok but 4 is quit a big
leap.<br>
<br>
Overall it is a bit risky to do it.<br>
You have three options:<br>
- upgrade properly but probably in two steps 6.2 -> 6.4 -> 6.6<br>
- use SSSD from 6.2 as is for now. It will have limited
functionality but can leverage AD users from the trust. You would
need to configure SSSD to use LDAP for authentication and point to
compat tree of IPA to take advantage of the trust. See details here:
<a class="moz-txt-link-freetext" href="http://www.freeipa.org/images/0/0d/FreeIPA33-legacy-clients.pdf">http://www.freeipa.org/images/0/0d/FreeIPA33-legacy-clients.pdf</a><br>
- take your chances and try a hybrid you propose but it is not a
formally supported configuration.<br>
<br>
<blockquote
cite="mid:CAPP+0vKsMhmLHcMaKSn6FQ7hKnyvyPPnNhhNy=azDvAL+YAoGw@mail.gmail.com"
type="cite">
<div dir="rtl">
<div dir="ltr"><br>
</div>
<div dir="ltr">Thanks in advance,</div>
<div dir="ltr">Genadi. </div>
<div dir="ltr"><br>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</body>
</html>