<div dir="ltr"><div><div>Hi Alexander, </div><div>Currently; FreeIPA 7.1 (Centos) </div><div>Client 6.6 (Centos) </div><div>NFS 6.6 (Centos) + Samba 3.6 </div><div>I have also samba file sharing running on NFS server which shares home directories to windows users as well. So NFS server is joined to windows domain as well as FreeIPA domain. </div>FreeIPA Server Automount Conf: /etc/auto.master: /- /etc/auto.direct /home /etc/auto.home --------------------------- /etc/auto.direct: --------------------------- /etc/auto.home: * -rw,no_subtree_check,crossmnt,sec=krb5i itifs01.itiad.my.ca:/samba/homes/& maps not connected to /etc/auto.master: NFS Server Krb5.conf: includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = <a href="http://FREEIPA.MY.CA">FREEIPA.MY.CA</a> dns_lookup_realm = true dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = yes [realms] <a href="http://FREEIPA.MY.CA">FREEIPA.MY.CA</a> = { pkinit_anchors = FILE:/etc/ipa/ca.crt } [domain_realm] .<a href="http://FREEIPA.MY.CA">FREEIPA.MY.CA</a> = <a href="http://FREEIPA.MY.CA">FREEIPA.MY.CA</a> <a href="http://FREEIPA.MY.CA">FREEIPA.MY.CA</a> = <a href="http://FREEIPA.MY.CA">FREEIPA.MY.CA</a> .<a href="http://itiad.my.ca">itiad.my.ca</a> = <a href="http://FREEIPA.MY.CA">FREEIPA.MY.CA</a> <a href="http://itiad.my.ca">itiad.my.ca</a> = <a href="http://FREEIPA.MY.CA">FREEIPA.MY.CA</a> NFS Server sssd.conf: cache_credentials = True krb5_store_password_if_offline = True ipa_domain = <a href="http://FREEIPA.my.CA">FREEIPA.my.CA</a> id_provider = ipa auth_provider = ipa access_provider = ipa ldap_tls_cacert = /etc/ipa/ca.crt ipa_hostname = <a href="http://itifs01.itiad.my.ca">itifs01.itiad.my.ca</a> chpass_provider = ipa ipa_dyndns_update = True ipa_server = _srv_, <a href="http://server.freeipa.my.ca">server.freeipa.my.ca</a> dns_discovery_domain = <a href="http://FREEIPA.my.CA">FREEIPA.my.CA</a> [sssd] services = nss, sudo, pam, ssh config_file_version = 2 domains = <a href="http://FREEIPA.MY.CA">FREEIPA.MY.CA</a> [nss] homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp] Client Krb5.conf: includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = <a href="http://FREEIPA.MY.CA">FREEIPA.MY.CA</a> dns_lookup_realm = true dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = yes [realms] <a href="http://FREEIPA.MY.CA">FREEIPA.MY.CA</a> = { pkinit_anchors = FILE:/etc/ipa/ca.crt } [domain_realm] .<a href="http://freeipa.my.ca">freeipa.my.ca</a> = <a href="http://FREEIPA.MY.CA">FREEIPA.MY.CA</a> <a href="http://freeipa.my.ca">freeipa.my.ca</a> = <a href="http://FREEIPA.MY.CA">FREEIPA.MY.CA</a> Client SSSD.conf: cache_credentials = True krb5_store_password_if_offline = True ipa_domain = <a href="http://freeipa.my.ca">freeipa.my.ca</a> id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = <a href="http://client2.freeipa.my.ca">client2.freeipa.my.ca</a> chpass_provider = ipa ipa_server = _srv_, <a href="http://server.freeipa.my.ca">server.freeipa.my.ca</a> ldap_tls_cacert = /etc/ipa/ca.crt autofs_provider = ipa ipa_automount_location = default [sssd] default_domain_suffix = <a href="http://itiad.my.ca">itiad.my.ca</a> services = nss, sudo, pam, autofs, ssh config_file_version = 2 domains = <a href="http://freeipa.my.ca">freeipa.my.ca</a> [nss] homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp] </div>Thanks, </div><div class="gmail_extra"> <div class="gmail_quote">On 29 September 2015 at 10:47, Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On Tue, 29 Sep 2015, Sadettin Albasan wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> I have a freeipa server and a trust relation with AD domain with almost everything working the way I planned except automounting NFS home directories for domain users. I have been reading about this on the net for almost a week, ended up trying a lot of different configurations, but I had no success to it. The closest I came to was removing krb5 authentication from the export and mount options. it is only then able to mount the directories. Since I have not seen any official guidelines about it, is this in works or any plan to implement? Thanks. </blockquote></div></div> As usual, more details are required about server and client configuration/software in order to even guess your problems. What provides NFS storage? What is used on the client machines? How identity mapping is configured. Give examples of your configuration. There are some issues in NFS identity mapping code that were fixed relatively recently and which prevented use of POSIX users with '@' in the name, for example. -- / Alexander Bokovoy </blockquote></div> </div>