<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi Tyler,<br>
<br>
Some comments below...I'm sure others will chime in :-)<br>
<br>
<div class="moz-cite-prefix">On 09/14/2015 10:33 AM, Milam, Tyler S
wrote:<br>
</div>
<blockquote
cite="mid:BY2PR07MB662360FAE0FC54ECB25B6CEBE5D0@BY2PR07MB662.namprd07.prod.outlook.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal">My organization is evaluating new methods
of user account provisioning in Linux. What advantages does
freeIPA offer over just SSSD?</p>
</div>
</blockquote>
<br>
Just to be clear, SS<br>
SD is the client that can work directly to an existing AD domain, or
indirectly to an AD domain via IdM/FreeIPA and a cross-realm
Kerberos trust.<br>
When you configure an IdM/FreeIPA client, SSSD is configured (via
ipa-client-install or realmd). In short:<br>
<br>
SSSD -> AD (Direct AD Integration)<br>
SSSD -> IdM/FreeIPA (standard configuration)<br>
SSSD -> IdM/FreeIPA <--- cross-realm Kerberos trust
---> AD (Indirect AD integration)<br>
<br>
In general, Direct AD integration is recommended for small
environments with few Linux clients.<br>
For larger numbers of clients, indirect AD integration is preferred
as it will give you more control, granularity<br>
to manage users, hosts, services, certs, keytabs, etc.<br>
<br>
There are some details that come into play - particularly around
which versions of RHEL (or non-RHEL) you're clients are on.<br>
Attached is a tech brief we put out for Summit that can help.<br>
<br>
<br>
<blockquote
cite="mid:BY2PR07MB662360FAE0FC54ECB25B6CEBE5D0@BY2PR07MB662.namprd07.prod.outlook.com"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Some background – we use Active Directory
for everything but have a small linux footprint (25 servers).
However, many services are going to be migrated from AIX to
Linux, and this will increase the number of Linux servers to
well over 100. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve been testing FreeIPA 4.1.0, but having
a hard time determining if sssd by itself is ‘enough’ or if
the additional complexity of setting up FreeIPA with a new DNS
zone and a 2-way trust with active directory can be justified.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Tyler<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Mark Heslin
Principal Technical Program Manager - EPM Team
Red Hat Inc.
office: +1 978-392-3125
mobile: +1 603-930-6880
</pre>
</body>
</html>