<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>Alex -</div>
<div>Thank you for the details!! </div>
<div><br>
</div>
<div>For right now, I’m using the IPA Server as a standalone Linux domain controller/server without any AD integration. This allows testing to prove that this could work with a large number of 5.5 clients in the enterprise to date. </div>
<div><br>
</div>
<div>On the question being proposed …</div>
<div>
<div>You haven't answered earlier when people asked whether you are using</div>
<div>cn=compat tree because you need to get information about Active</div>
<div>Directory users or not.</div>
</div>
<div><br>
</div>
<div>ANSWER:</div>
<div>Yes. I’m trying to achieve full integration with AD but I’m only at the point where I started testing this in a standalone Linux mode. I was trying to see if these legacy 5.5 clients were even possible to configure and to work here as specified. </div>
<div><br>
</div>
<div>I’ll review the IPA tools for better understanding here. </div>
<div><br>
</div>
<div>
<div style="background-color: rgb(255, 255, 255); font-family: Tahoma; font-size: 13px;">
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<b><span style="font-size: 10pt; font-family: 'Palatino Linotype', serif; color: rgb(31, 73, 125);">Jeffrey Stormshak, RHCSA | Sr. Linux Engineer</span></b></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="font-family: 'Palatino Linotype', serif; font-size: 10pt;">Platform Systems | IT Operations Infrastructure</span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="font-family: 'Palatino Linotype', serif; font-size: 10pt;">CCC Information Services, Inc.</span></p>
<p class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="font-family: 'Palatino Linotype', serif; font-size: 10pt;">Phone: (312) 229-2552</span></p>
</div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com">abokovoy@redhat.com</a>><br>
<span style="font-weight:bold">Date: </span>Tuesday, November 24, 2015 at 7:57 AM<br>
<span style="font-weight:bold">To: </span>Jeffrey Stormshak <<a href="mailto:jstormshak@cccis.com">jstormshak@cccis.com</a>><br>
<span style="font-weight:bold">Cc: </span>Jakub Hrozek <<a href="mailto:jhrozek@redhat.com">jhrozek@redhat.com</a>>, Rob Crittenden <<a href="mailto:rcritten@redhat.com">rcritten@redhat.com</a>>, "<a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>"
<<a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [Freeipa-users] Oracle Linux 5.5 - Legacy Question<br>
</div>
<div><br>
</div>
<div>
<div>
<div>On Tue, 24 Nov 2015, Jeffrey Stormshak wrote:</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div>I went to review the ‘ip_provider’ and that looks like a ‘sssd.conf’</div>
<div>setting. The sssd RPM isn’t located on the 5.5 clients; nor is it in</div>
<div>the YUM Channels for 5.5 base and 5.5 patch. So is the recommendation</div>
<div>here to find any 5.X version of sssd RPM and use that for this</div>
<div>configuration? Sorry, being a newbie on this product realistically</div>
<div>isn’t helping here I’m sure …</div>
<div><br>
</div>
<div>The ipa-advise, is that part of the ipa-client RPM? That too, doesn’t</div>
<div>exist on the 5.5 distribution as well. Even the version required to</div>
<div>fix the openssl only worked with the 5.7 base version. Am I complete</div>
<div>doomed for 5.5? Cards are stacked for sure. Nonetheless …</div>
</blockquote>
<div>ipa-advise is a tool on IPA server that provides recipes how to</div>
<div>configure different clients for a typical scenarios involving trust to</div>
<div>AD.</div>
<div><br>
</div>
<div>Read the manual for the tool to get more information.</div>
<div><br>
</div>
<div>For legacy clients where there is no recent enough SSSD to support trust</div>
<div>to AD natively, ipa-advise recommends using schema compatibility plugin</div>
<div>to expose both IPA and AD users under same LDAP tree. This is what you</div>
<div>see in cn=users,cn=compat,dc=example,dc=com. If you see cn=compat in the</div>
<div>LDAP base DN, you know you are looking into the compatibility tree.</div>
<div><br>
</div>
<div>Compatibility tree is handled by a special plugin which combines data</div>
<div>from the primary IPA tree (cn=accounts,dc=example,dc=com) and from SSSD</div>
<div>on IPA server. It also exposes ou=SUDOers subtree to allow SUDO</div>
<div>application to work with sudo rules stored in IPA LDAP (they are not in</div>
<div>the same format as SUDO itself expects, thus _compatibility_ subtree).</div>
<div><br>
</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div>I feel so close though… Auth and Sudo works on 5.5 but something as</div>
<div>simple as users changing passwords seems so simple to provide?</div>
</blockquote>
<div>Finally, password changes are not supported in cn=compat subtree. This</div>
<div>is simply not implemented by schema compatibility plugin.</div>
<div><br>
</div>
<div>You haven't answered earlier when people asked whether you are using</div>
<div>cn=compat tree because you need to get information about Active</div>
<div>Directory users or not. If you don't need integration with Active</div>
<div>Directory, change LDAP base DN in your configuration to</div>
<div>cn=accounts,dc=example,dc=com, to point your clients to the primary IPA</div>
<div>subtree where all users and groups are available. That subtree is the</div>
<div>main one and we do support password changes for DNs in it.</div>
<div><br>
</div>
<div>-- </div>
<div>/ Alexander Bokovoy</div>
<div><br>
</div>
</div>
</div>
</span>
</body>
</html>