<html><body><div style="font-family: lucida console,sans-serif; font-size: 10pt; color: #000000"><div><br><div data-marker="__QUOTED_TEXT__"><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div data-marker="__QUOTED_TEXT__"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote"><span class="gmail-">> - User/group management in general becomes largely a command-line operation (such as mapping groups so they can be used in HBAC and sudo rules)<br> <br> </span>While this is a nice-to-have, it isn't a deal breaker.<br></blockquote><br><div>This definitely exists in WebUI? Unless you mean something I don't understand.<br><br></div><div>Define groups: <br>Identity->User Groups (second tab)</div></div></div></div></div></blockquote> In my setup (FreeIPA 4.4.0 on CentOS 7) I don't see external users (users that are known via the trust with AD) under the "Users" tab. There is limited visibility / management of external groups and membership, but nothing that displays a list of available users/groups in AD when attempting to create/modify a user/group. <blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div data-marker="__QUOTED_TEXT__"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div>Define user mappings:<br></div><div>IPA Server -> ID Views -> Default Trust View<br></div></div></div></div></div></blockquote><div>By "mapping" I meant adding an AD group to a FreeIPA group (which can be used for HBAC/sudo) so that AD membership is known by IPA when applying the HBAC/sudo rules. For example:<br></div><div><br data-mce-bogus="1"></div><div>ipa group-add \<br> --desc="lab.gen.zone 'Domain Admins' external map" \<br> lgz_map_domain_admins \<br> --external<br>ipa group-add \<br> --desc="lab.gen.zone 'Domain Admins' POSIX" \<br> lgz_domain_admins<br>ipa group-add-member \<br> lgz_map_domain_admins \<br> --external 'LAB\Domain Admins'<br>ipa group-add-member \<br> lgz_domain_admins \<br> --groups lgz_map_domain_admins<br data-mce-bogus="1"></div><div><br data-mce-bogus="1"></div></div></div></div></body></html>