<html><head></head><body><div>On Fri, 2016-05-13 at 15:14 +0200, Sumit Bose wrote:</div><blockquote type="cite"><pre>On Wed, May 11, 2016 at 05:17:03PM +0100, lejeczek wrote:
<blockquote type="cite">
.. if possible, would you know?
hi everybody,
I'm trying, and hoping it is possible to realm join an AD but is such a
way so I tap my IPA into specific OU within that AD.
</blockquote>
I'm not exactly sure what you mean here. Do you want to join a computer
which is already a client in an IPA domain to AD as well? If this is the
case I would recommend to consider the IPA trust feature. Joining 2
domain is in general possible with SSSD but has to be done with very
great care, e.g. by using different keytabs for each domain.
</pre></blockquote><div>Can IPA domain establish a trust between win AD if IPA admin only has admin control over an OU in win AD ?</div><div>I know very little about AD and only started with IPA - I don't suppose control of OU delegated to a user makes that user AD admin.</div><div>I guess what I'm thinking, asking, is - what would be the correct possible way to plug in, connect IPA domain to win AD when one has admin control only over a OU in win AD?</div><div>many thanks</div><div>L.</div><div><br></div><blockquote type="cite"><pre>
<blockquote type="cite">
The thing is - I'm thinking it would make user access control ideal
from the start as I need only users from that OU, but also because I'm
only granted access to the user/group who has control over that OU.
I'm trying that but I see:
! The computer account RIDER already exists, but is not in the desired
organizational unit.
adcli: joining domain ccc.bb.aa failed: The computer account RIDER
already exists,
</blockquote>
Computer account names in AD must be unique even if they are added to
different OUs. So if there is already a computer called RIDER joined to
AD and it is not your computer you have to rename your computer to join.
If it is your computer and you want to create it in a different OU you
have to delete to old computer object first and then do a fresh join.
HTH
bye,
Sumit
<blockquote type="cite">
! Failed to join the domain
I'm doing this:
$ realm join ccc.bb.aa --user=private-user --computer-ou=private
and computer is in OU=private of ccc.bb.aa
so is the user private-user
many thanks.
L##SELECTION_END##
</blockquote>
<blockquote type="cite">
--
Manage your subscription for the Freeipa-users mailing list:
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a>
Go to <a href="http://freeipa.org">http://freeipa.org</a> for more info on the project
</blockquote>
</pre></blockquote></body></html>