<html> <head> <meta http-equiv="content-type" content="text/html; charset=utf-8"> </head> <body text="#000000" bgcolor="#FFFFFF"> I'm exploring using AD trusts, and am trying to find a good way to get better management of trusted objects within FreeIPA. One example, I add an AD user to an external group, and then add that group to a POSIX group. When I want to view all the members of the POSIX group, I can only see the native FreeIPA users. I have to manually go into each nested group, and view all the external members to determine who is in the top group. But from the command line a `getent group FOO` shows nested members fine. Another example, I see an external user in a group, and I want more information about this user. Their name, department, etc. I can't get it. I have to go into AD to find out who this user is. It would be nice if I could see this info from within FreeIPA. Or if I want to add an external user to a group, I have to know that user's exact AD logon name. If I only have their real name, or other information, I can't search for them and then add them to the group. Is there any way to make these types of management tasks simpler? If not, is such a thing on the road map? Or as an alternative, is it possible to use the winsync plugin to pull users from AD, but whenever such a user tries to authenticate, the authentication is performed against AD? So that FreeIPA is used for authorization, but not authentication? Thanks -Patrick </body> </html>