9:51 a.m.
Hello,
We're currently evaluating FreeIPA for handling the linux side of idm, with AD as the
upstream provider.
At this time, it seems everything is working well, but SSH into both ipa clients and
servers as AD users does not. Sumit has provided a few suggestions in the past which have
been addressed.
The setup is stock with the following config:
- M$ AD 2016, FreeIPA 4.6.4, sssd 1.16.2-13, all el7.6
- Verified Two-way trust between IPA and AD
- AD domain is splat.acme.com, IPA domain is ipa.splat.acme.com
- All ipa-clients are on the splat.acme.com domain, and all users are
username(a)splat.acme.com
- Only ipa-servers are on the ipa.splat.acme.com domain.
- In our setup, UID == GID, not sure if that matters.
- In SSSD, under ipa.splat.acme.com ldap_search_timeout and krb5_auth_timeout have been
increased.
Further info:
- IPA can resolve AD group/user memberships and attributes. The AD users belong in a group
which is an external member of an IPA group.
- All relevant AD users and groups have unix attrs which fall within the idrange used by
the trust
- ldbsearch of cache and ldapsearch both show proper results when resolving a user.
- SSSD sites work, no indication that any data providers are offline in the logs.
- kinit $user, and kvno -S $cross_domain_stuff works. ID command works.
- The attached logs come from an attempt to ssh into the IPA server as an AD user,
attempts to ssh into IPA clients show similar behavior.
Thanks for your time everyone,
D