<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body lang="EN-AU" link="#0563C1" vlink="#954F72"> <div class="WordSection1"> We were doing this by utilising overrides (changing user names, /home/ s, etc), but I think we had to back out of that plan because we encountered issues. We may go back.<o:p></o:p> <o:p> </o:p> Using Host Based Access Control (HBAC) and sudo is a powerful set of tools. What did you want to do that wasn’t covered by those three?<o:p></o:p> <o:p> </o:p> <o:p> </o:p> L.<o:p></o:p> <o:p> </o:p> <o:p> </o:p> <div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt"> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: Redmond, Stacy [mailto:stacy.redmond@blueshieldca.com] Sent: Wednesday, 25 May 2016 9:15 AM To: Simpson Lachlan Subject: RE: AD replication and password passthrough<o:p></o:p> </div> </div> <o:p> </o:p> I am replacing ODS, and would like to replicate AD (ad.foo.com) to my new IPA installation (ipa.foo.com) but in all the documentation it says I have to install passsync on AD to synchronize passwords, I would rather just tell ipa to authorize the user via password from AD.<o:p></o:p> <o:p> </o:p> I have a one way trust setup now, just would rather have everything in IPA, but use AD passwords due to new requirements.<o:p></o:p> <o:p> </o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: Simpson Lachlan [<a href="mailto:Lachlan.Simpson@petermac.org">mailto:Lachlan.Simpson@petermac.org</a>] Sent: Tuesday, May 24, 2016 4:09 PM To: Redmond, Stacy <<a href="mailto:stacy.redmond@blueshieldca.com">stacy.redmond@blueshieldca.com</a>> Subject: RE: AD replication and password passthrough<o:p></o:p> </div> </div> <o:p> </o:p> <div> ** BSCA security warning: Do not click links or trust the content unless you expected this email and trust the sender – This email originated outside of Blue Shield. **<o:p></o:p> </div> It depends on what you mean.<o:p></o:p> <o:p> </o:p> If, by replication, you mean using FreeIPA as a backup AD server, it would need to be a two way trust.<o:p></o:p> <o:p> </o:p> If you have a separate subdomain, it’s definitely possible with a one way trust.<o:p></o:p> <o:p> </o:p> Cheers<o:p></o:p> L.<o:p></o:p> <o:p> </o:p> <div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt"> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: <a href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a> [<a href="mailto:freeipa-users-bounces@redhat.com">mailto:freeipa-users-bounces@redhat.com</a>] On Behalf Of Redmond, Stacy Sent: Tuesday, 24 May 2016 3:15 AM To: <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Subject: [Freeipa-users] AD replication and password passthrough<o:p></o:p> </div> </div> <o:p> </o:p> Is there a way to setup replication from AD, and just use passthrough to AD for passwords, vs having to synchronize passwords. I am getting a lot of pushback from the AD team on installing the password sync software due to issues in the past. I would like to setup replication, but still use AD to authenticate passwords.<o:p></o:p> </div> This email (including any attachments or links) may contain confidential and/or legally privileged information and is intended only to be read or used by the addressee. If you are not the intended addressee, any use, distribution, disclosure or copying of this email is strictly prohibited. Confidentiality and legal privilege attached to this email (including any attachments) are not waived or lost by reason of its mistaken delivery to you. If you have received this email in error, please delete it and notify us immediately by telephone or email. Peter MacCallum Cancer Centre provides no guarantee that this transmission is free of virus or that it has not been intercepted or altered and will not be liable for any delay in its receipt. <o:p> </o:p> </div> </div> </body> </html> This email (including any attachments or links) may contain confidential and/or legally privileged information and is intended only to be read or used by the addressee. If you are not the intended addressee, any use, distribution, disclosure or copying of this email is strictly prohibited. Confidentiality and legal privilege attached to this email (including any attachments) are not waived or lost by reason of its mistaken delivery to you. If you have received this email in error, please delete it and notify us immediately by telephone or email. Peter MacCallum Cancer Centre provides no guarantee that this transmission is free of virus or that it has not been intercepted or altered and will not be liable for any delay in its receipt.