[Freeipa-users] control (auth) over part(s) of a forest/domain

[lejeczek]

hi everybody

I'm still new to this complex concept of cross-trust & 
domains, I wonder...
Would having own OU inside a win domain be any good in terms 
of controlling/allowing access to IPA boxes?
Or... probably best would be if I put it this way - if you 
want to plug yourself in, with your IPA domain, into a win 
AD (you could only have the authority over your own OU) and 
you have a bunch of people you look after (whose accounts 
exist already in AD) and they all (almost) use poor windows 
and they need to use your IPA linuxes (mostly samba but not 
only) then...  how do you go about it?

for your thoughts & advices
many thanks
L.