<div dir="ltr">Thank you for your answer but ...<br><div class="gmail_extra"><br><div class="gmail_quote">2015-11-23 16:36 GMT+01:00 Simo Sorce <span dir="ltr"><<a href="mailto:simo@redhat.com" target="_blank">simo@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span>On Wed, 2015-11-18 at 11:46 +0100, Domineaux Philippe wrote:<br> > Here is my environment :<br> ><br> > 1 Windows Domain<br> > Windows workstations<br> > Windows servers<br> > Multiple linux domains<br> > Linux workstations<br> > Linux servers<br> ><br> > Here is my goal :<br> ><br> > All users are centralized in the Active Directory.<br> > Users will authenticate on linux workstations with their AD accounts (<br> > using POSIX attributes).<br> > Linux workstations must have access to NFS shares on Linux servers.<br> <br> </span>Hi Domineaux,<br> you should look into setting up FreeIPA with a trust relationship to the<br> Windows Domain.<br> <span><br></span></blockquote><div><br></div><div>That's already the case, I use the Trust relationship with POSIX attributes.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span> > What are the limitations ?<br> <br> </span>It is hard to say what kind of limitations you are interested into, when<br> we trust AD, then AD users can access Linux machines, one limitation (if<br> you think it is a limitation) is that AD users will have fully qualified<br> names on the host (example: <a href="mailto:user@ad.example.com" target="_blank">user@ad.example.com</a>) and not just flat names<br> to avoid name clashes between ipa users, local users and AD users.<br> <span><br></span></blockquote><div><br></div><div>I'm ok with the use of fully qualified names, I use it to log in to my workstations.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span> > Windows users equals ipa users in term of services ?<br> <br> </span>Yes.<br> <span><br> > Do I have to configure kerberos to also join directly the Windows Kerberos<br> > Realm,<br> > or will IPA do the job to ask Windows server ?<br> <br> </span>If you set up a trust between servers all is taken care of for you wrt<br> clients.<br> <div><div><br> > in etc/krb5.conf :<br> ><br> > includedir /var/lib/sss/pubconf/krb5.include.d/<br> ><br> > [libdefaults]<br> > default_realm = <a href="http://IPA.ORG" rel="noreferrer" target="_blank">IPA.ORG</a><br> > dns_lookup_realm = true<br> > dns_lookup_kdc = true<br> > rdns = false<br> > ticket_lifetime = 24h<br> > forwardable = yes<br> > udp_preference_limit = 0<br> > default_ccache_name = KEYRING:persistent:%{uid}<br> > canonicalize = yes<br> > allow_weak_crypto = true<br> ><br> > [realms]<br> > <a href="http://IPA.ORG" rel="noreferrer" target="_blank">IPA.ORG</a> = {<br> > pkinit_anchors = FILE:/etc/ipa/ca.crt<br> > auth_to_local = RULE:[1:$1@<br> > $0](^.*@WINDOMAIN.LOCAL$)s/@WINDOMAIN.LOCAL/@windomain.local/<br> > auth_to_local = DEFAULT<br> ><br> > }<br> ><br> > ### IS THIS NECESSARY<br> > WINDOMAIN.LOCAL = {<br> > kdc = srvadipa.windomain.local<br> > admin_server = srvadipa.windomain.local<br> > }<br> ><br> ><br> > [domain_realm]<br> > .<a href="http://ipa.org">ipa.org</a> = <a href="http://IPA.ORG">IPA.ORG</a><br> > <a href="http://ipa.org">ipa.org</a> = <a href="http://IPA.ORG">IPA.ORG</a><br> ><br> > ### IS THIS NECESSARY<br> ><br> > .windomain.local = WINDOMAIN.LOCAL<br> > windomain.local = WINDOMAIN.LOCAL<br> <br> </div></div>It depends on what client you are using, older RHEL may need this, newer<br> ones have an include directory in krb5.conf and sssd generates<br> appropriate configuration automatically based on server configuration.<br> <span><br> > Is the bug in libnfsidmap still active and prevents Windows users to access<br> > to NFS4 krb5 secured shared folder ?<br> <br> </span>I am not sure what bug you refer to. You may need to configure nfs<br> client nfs idmap, but I am not aware of bugs that will prevent it from<br> working right if properly configured.<br> <br></blockquote><div><br></div><div>The bug specified below return me this on the NFS server (part of the ipa domain ) :</div><div><br></div><div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[4823]: nfsdcb: authbuf=gss/krb5 authtype=user</div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[4823]: Server : (user) id "650800001" -> name "<a href="mailto:testipa@ipa.org">testipa@ipa.org</a>"</div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[4823]: nfsdcb: authbuf=gss/krb5 authtype=group</div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[4823]: Server : (group) id "650800001" -> name "<a href="mailto:testipa@ipa.org">testipa@ipa.org</a>"</div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[4823]: nfsdcb: authbuf=gss/krb5 authtype=user</div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[4823]: Server : (user) id "65534" -> name "<a href="mailto:nfsnobody@ipa.org">nfsnobody@ipa.org</a>"</div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[4823]: nfsdcb: authbuf=gss/krb5 authtype=group</div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[4823]: Server : (group) id "65534" -> name "<a href="mailto:nfsnobody@ipa.org">nfsnobody@ipa.org</a>"</div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[4823]: nfsdcb: authbuf=gss/krb5 authtype=user</div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[6237]: nfsdcb: authbuf=gss/krb5 authtype=user</div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[4823]: Server : (user) id "10002" -> name "adipa@windomain.local@<a href="http://ipa.org">ipa.org</a>"</div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[4823]: nfsdcb: authbuf=gss/krb5 authtype=group</div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[6237]: nfs4_uid_to_name: calling nsswitch->uid_to_name</div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[4823]: Server : (group) id "10047" -> name "posix_users@windomain.local@<a href="http://ipa.org">ipa.org</a>"</div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[4823]: nfsdcb: authbuf=gss/krb5 authtype=user</div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[4823]: Server : (user) id "0" -> name "<a href="mailto:root@ipa.org">root@ipa.org</a>"</div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[4823]: nfsdcb: authbuf=gss/krb5 authtype=group</div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[4823]: Server : (group) id "0" -> name "<a href="mailto:root@ipa.org">root@ipa.org</a>"</div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[6237]: nfs4_uid_to_name: nsswitch-><b>uid_to_name returned 0</b></div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[6237]: nfs4_uid_to_name: <b>final return value is 0</b></div><div>Nov 17 15:12:33 centos-nfs rpc.idmapd[6237]: Server : (user) id "650800001" -> name "<a href="mailto:testipa@ipa.org">testipa@ipa.org</a>"</div></div><div> </div><div><br></div><div>So it seems that for a native ipa user ( in my case testipa ) , the uid is return but for an AD user, it returns me zero.</div><div>The result is that when I am logged on a workstation using an AD account I see nfs shares with nobody attributes.</div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"> Specifically you may want to *not* try to consult LDAP from idmap, but<br> use a regex to transform the windows realm from upper case to lowercase<br> and then just use the getpwnam interface.<br> <br></blockquote><div><br></div><div>As you can see on my krb5.conf there is already a regex for the ipa realm =</div><div><br></div><div>auth_to_local = RULE:[1:$1@<br>> $0](^.*@WINDOMAIN.LOCAL$)s/@WINDOMAIN.LOCAL/@windomain.local/<br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"> Simo.<br> <div><div><br> > I currently have<br> ><br> > bug here:<br> > <a href="https://www.redhat.com/archives/freeipa-users/2014-June/msg00163.html" rel="noreferrer" target="_blank">https://www.redhat.com/archives/freeipa-users/2014-June/msg00163.html</a><br> </div></div><span><font color="#888888">> --<br> > Manage your subscription for the Freeipa-users mailing list:<br> > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br> > Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br> <br> <br> --<br> Simo Sorce * Red Hat, Inc * New York<br> <br> </font></span></blockquote></div><br></div></div>