<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Thanks for all the info. I think I will go the trust route with IPA 4.1 and see what happens (in a test environment first of course.)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> freeipa-users-bounces@redhat.com [mailto:freeipa-users-bounces@redhat.com]
<b>On Behalf Of </b>Steven Jones<br>
<b>Sent:</b> Tuesday, February 17, 2015 6:25 PM<br>
<b>To:</b> freeipa-users@redhat.com<br>
<b>Subject:</b> Re: [Freeipa-users] question about Active Directory authentication<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div id="divtagdefaultwrapper">
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black">Ok,<o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black">So with winsync I will have the 2000+ users in IPA.<o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black">Within IPA I have several high risk/impact groups of servers and many low.<o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black">For the low risk/impact servers and most desktops they can trust what AD tells them. For the high risk/impact servers/applications we do not want to reply on AD for any
authorisation so permissions for these will be isolated from AD inside IPA. The idea is if we lose AD or IPA we should not lose both via any cross-linking.<o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<div id="Signature">
<div name="divtagdefaultwrapper">
<div>
<div>
<div>
<p style="background:white"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black">regards<o:p></o:p></span></p>
<p style="background:white"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif;color:black">Steven<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
<div>
<div class="MsoNormal" align="center" style="text-align:center;background:white">
<span style="font-family:"Calibri",sans-serif;color:#212121">
<hr size="2" width="98%" align="center">
</span></div>
<div id="divRplyFwdMsg">
<p class="MsoNormal" style="background:white"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">
<a href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a> <<a href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a>> on behalf of Dmitri Pal <<a href="mailto:dpal@redhat.com">dpal@redhat.com</a>><br>
<b>Sent:</b> Wednesday, 18 February 2015 11:51 a.m.<br>
<b>To:</b> <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><br>
<b>Subject:</b> Re: [Freeipa-users] question about Active Directory authentication</span><span style="font-family:"Calibri",sans-serif;color:#212121">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="background:white"><span style="font-family:"Calibri",sans-serif;color:#212121"> <o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-family:"Calibri",sans-serif;color:#212121">On 02/17/2015 05:21 PM, Steven Jones wrote:<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div id="divtagdefaultwrapper">
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div id="divtagdefaultwrapper">
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black">***maybe***<o:p></o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black"><o:p> </o:p></span></p>
<p style="background:white"><span style="font-family:"Calibri",sans-serif;color:black">c) You might be able to do both winsync and trusts at the same time then that is simpler provisioning. ie a user gets created in AD and automatically gets created in IPA
ready for you to put in the user group you want.<o:p></o:p></span></p>
</div>
</blockquote>
<p class="MsoNormal" style="background:white"><span style="font-family:"Calibri",sans-serif;color:#212121"><br>
I am not sure this is the best solution really.<br>
Trust and sync do not help each other. The fact that you have trust does not help you to provision users the way you describe.<br>
<br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><span style="font-family:"Calibri",sans-serif;color:#212121">8><------<br>
<br>
They achieve different things. How otherwise do I get 2000+ AD users into IPA? To me winsync allows automated provisioning of users into IPA via AD, this greatly reduces manual effort.
<o:p></o:p></span></p>
</div>
</div>
</div>
</blockquote>
<p class="MsoNormal" style="background:white"><span style="font-family:"Calibri",sans-serif;color:#212121"><br>
That I get. I do not understand how trust helps you in this case.<br>
<br>
<br>
<o:p></o:p></span></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div id="divtagdefaultwrapper">
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt;background:white"><span style="font-family:"Calibri",sans-serif;color:#212121"><br>
<br>
<o:p></o:p></span></p>
</div>
</div>
</div>
<p class="MsoNormal" style="background:white"><span style="font-family:"Calibri",sans-serif;color:#212121"><br>
<br>
<o:p></o:p></span></p>
</blockquote>
<p class="MsoNormal" style="background:white"><span style="font-family:"Calibri",sans-serif;color:#212121"><br>
<br>
<br>
<o:p></o:p></span></p>
<pre style="background:white"><span style="color:#212121">-- <o:p></o:p></span></pre>
<pre style="background:white"><span style="color:#212121">Thank you,<o:p></o:p></span></pre>
<pre style="background:white"><span style="color:#212121">Dmitri Pal<o:p></o:p></span></pre>
<pre style="background:white"><span style="color:#212121"><o:p> </o:p></span></pre>
<pre style="background:white"><span style="color:#212121">Sr. Engineering Manager IdM portfolio<o:p></o:p></span></pre>
<pre style="background:white"><span style="color:#212121">Red Hat, Inc.<o:p></o:p></span></pre>
</div>
</div>
</div>
</div>
</body>
</html>