<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!-- p { margin-top: 0px; margin-bottom: 0px; }--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>I'm on my second attempt trying to set up an IPA server with a trust relationship to our AD domain. The first attempt had inexplicable problems with winbind, so this time I've set up a RHEL7 server, and things are going better, but I'm stuck when trying
to add an AD user group to an IPA group.<br>
</p>
<p><br>
</p>
<p>I have already:<br>
</p>
<p>- created an IPA group called ad_users.<br>
</p>
<p>- created an IPA group called ad_users_external.<br>
</p>
<p>- added ad_users_external as a member of ad_users.<br>
</p>
<p><br>
</p>
<p>But the final step isn't working:<br>
</p>
<p>ipa group-add-member ad_users_external --external "AD\IPA Users"<br>
</p>
<p><br>
</p>
<p>gives:<br>
</p>
<p>ipa: ERROR: attribute "ipaExternalMember" not allowed<br>
</p>
<p><br>
</p>
<p>How can I fix this?<br>
</p>
<p><br>
</p>
<p>Also, I discovered that even without adding this AD group, every AD user in our domain can SSH to the IPA server. That's convenient for the users, but not really what I'm looking for. Why aren't logins restricted to users in the ad_users group?<br>
</p>
<p><br>
</p>
<p>David Guertin<br>
</p>
</body>
</html>