<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Hi,</div><div><br data-mce-bogus="1"></div><div>I can configrm that UPN issue is fixed in RHEL 7.3. That is great, thank you a lot. </div><div>It looks like solution came with sssd 1.14.x right ? Anybody knows if there are plans to implement it into RHEL 6.x (ipa-client) ? Currently my ipa-clients on RHEL 6.8 (sssd 1.13.3.-22) are not able to handle that.<br></div><div><br data-mce-bogus="1"></div><div>Thanks,</div><div data-marker="__SIG_PRE__">Jan <br><br></div><div data-marker="__SIG_PRE__"><br data-mce-bogus="1"></div><div data-marker="__SIG_PRE__"><span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; display: inline !important; float: none;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; display: inline !important; float: none;">---------------------------------------------------------------------- </span></div><div data-marker="__SIG_PRE__"><br data-mce-bogus="1"></div><div data-marker="__HEADERS__"><b>From: </b>"Jan Karásek" <jan.karasek@elostech.cz><br><b>To: </b>freeipa-users@redhat.com<br><b>Sent: </b>Tuesday, May 10, 2016 4:44:14 PM<br><b>Subject: </b>AD trust and UPN issue<br></div><div><br></div><div data-marker="__QUOTED_TEXT__">Hi, <br><br>thank you for the answer. I have already tried that workaround and still no luck. At the moment this is showstopper for us on two different projects at two different customers. <br>Any chance to get it patch before 7.3 arrives ? <br><br>Thanks, <br>Jan <br>---------------------------------------------------------------------- <br><br><br>Date: Tue, 10 May 2016 14:38:01 +0200 <br>From: Jakub Hrozek <jhrozek@redhat.com> <br>To: freeipa-users@redhat.com <br>Subject: Re: [Freeipa-users] Fwd: AD trust and UPN issue <br>Message-ID: <20160510123801.GE4011@hendrix> <br>Content-Type: text/plain; charset=iso-8859-1 <br><br>On Tue, May 10, 2016 at 02:17:07PM +0200, Jan Kar?sek wrote: <br>> Hi all, <br>> I have lab environment with IPA server and trust to Active directory. <br>> IPA server is in a.example.com. <br>> AD DC is in example.com. <br>> We have also child AD subdomain ext.examle.com. <br>> Everything is fine until the users in AD domain ext.example.com gets the UPN suffix of the root AD domain - example.com - which is pretty common scenario. <br>> Example: <br>> user at ext.examaple.com is set in AD with UPN user at example.com <br>> <br>> In this situation I am not able to login into my linux box with user at example.com <br>> I have seen some open tickets on this issue 3559 and others, and they are marked as fixed in IPA 4.2 ... but I not sure if its already fixed in current packages. <br>> Currently I am testing on RHEL7 with ipa-server-4.2.0-15.el7_2.6.1.x86_64 and the same situation is on Fedora 23 with freeipa-server-4.2.4-1.fc23.x86_64. <br>> I have default settings - no changes in krb5.conf and sssd.conf after ipa trust-add. <br>> Also I have found the workaround to set in krb5.conf (see topic: Cannot find KDC for realm "MYDOMAIN.NET" - AD trust and UPN issues in RH archive ) - add another realm just with EXT.EXAMPLE.COM = { kdc = ad.ext.example.com:88 } - but no effect. <br>> Could you please confirm, that its possible to use IPA with different UPN suffix for users in AD than the domain name in which they are exists ? Is there any additional configuration needed to fix this scenario ? <br><br>In general no, not until 7.3. But it might work with a workaround. Can <br>you try setting: <br>ldap_user_principal = nosuchattr <br>subdomain_inherit = ldap_user_principal <br>in sssd.conf's domain section on the server? (Yes, server, not client..) <br><br>This should work without the workaround starting with 7.3..<br><br>Jan K<br><br><br>----- Original Message -----<br>From: "freeipa-users-request" <freeipa-users-request@redhat.com><br>To: freeipa-users@redhat.com<br>Sent: Tuesday, May 10, 2016 4:23:56 PM<br>Subject: Freeipa-users Digest, Vol 94, Issue 63<br><br>---------------------------------------------------------------------- <br><br><br>Date: Tue, 10 May 2016 14:38:01 +0200 <br>From: Jakub Hrozek <jhrozek@redhat.com> <br>To: freeipa-users@redhat.com <br>Subject: Re: [Freeipa-users] Fwd: AD trust and UPN issue <br>Message-ID: <20160510123801.GE4011@hendrix> <br>Content-Type: text/plain; charset=iso-8859-1 <br><br>On Tue, May 10, 2016 at 02:17:07PM +0200, Jan Kar?sek wrote: <br>> Hi all, <br>> I have lab environment with IPA server and trust to Active directory. <br>> IPA server is in a.example.com. <br>> AD DC is in example.com. <br>> We have also child AD subdomain ext.examle.com. <br>> Everything is fine until the users in AD domain ext.example.com gets the UPN suffix of the root AD domain - example.com - which is pretty common scenario. <br>> Example: <br>> user at ext.examaple.com is set in AD with UPN user at example.com <br>> <br>> In this situation I am not able to login into my linux box with user at example.com <br>> I have seen some open tickets on this issue 3559 and others, and they are marked as fixed in IPA 4.2 ... but I not sure if its already fixed in current packages. <br>> Currently I am testing on RHEL7 with ipa-server-4.2.0-15.el7_2.6.1.x86_64 and the same situation is on Fedora 23 with freeipa-server-4.2.4-1.fc23.x86_64. <br>> I have default settings - no changes in krb5.conf and sssd.conf after ipa trust-add. <br>> Also I have found the workaround to set in krb5.conf (see topic: Cannot find KDC for realm "MYDOMAIN.NET" - AD trust and UPN issues in RH archive ) - add another realm just with EXT.EXAMPLE.COM = { kdc = ad.ext.example.com:88 } - but no effect. <br>> Could you please confirm, that its possible to use IPA with different UPN suffix for users in AD than the domain name in which they are exists ? Is there any additional configuration needed to fix this scenario ? <br><br>In general no, not until 7.3. But it might work with a workaround. Can <br>you try setting: <br>ldap_user_principal = nosuchattr <br>subdomain_inherit = ldap_user_principal <br>in sssd.conf's domain section on the server? (Yes, server, not client..) <br><br>This should work without the workaround starting with 7.3..<br></div></div></body></html>