Is it possible to use the FreeIPA LDAP interface to authenticate AD users?

[Chris Dagdigian]

My use case on AWS involves ephemeral or auto-scaling servers that do 
not live long enough to justify a formal IPA enroll/un-enroll process.

We have a great AD-integrated IPA system running at the moment and I've 
been able to configure a light test client that trusts the IPA CA 
certificate and will become an LDAPS client of the FreeIPA server

This works great for local IPA users but I'm trying to think this 
through and I'm not sure if I can use LDAP to authenticate an AD user? 
Is this even possible?

This is my working sssd.conf for a test client that just uses LDAP -- 
works great for resolving users and groups that are local IPA users but 
so far I can't resolve any of the AD resident users:

[domain/default]
autofs_provider = ldap
cache_credentials = True
ldap_search_base = cn=users,cn=accounts,dc=ipa,dc=example,dc=com
ldap_group_search_base = cn=groups,cn=accounts,dc=ipa,dc=example,dc=com
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
ldap_uri = ldap://ipa001.ipa.example.com/
ldap_id_use_start_tls = True
ldap_tls_cacertdir = /etc/pki/tls/
default_shell = /bin/bash
override_shell = /bin/bash


Is there any method using ldap_search_base or an override of the Default 
Trust View that would allow me to deploy a client that only talks LDAP 
to FreeIPA but is able to resolve and authenticate AD users?  I'm 
wondering if this is even possible or if I'm looking at a lost cause. 
Thanks!

Chris

[Louis Abel]

You can do this by enabling the compat tree in FreeIPA. I believe this will involve you
having to run ipa-adtrust-install --enable-compat on all IPA servers that are involved
either being a trust controller or trust agent. You'll essentially have these trees
after that you can use:

Groups: cn=groups,cn=compat,dc=ipa,dc=example,dc=com
Users; cn=users,cn=compat,dc=ipa,dc=example,dc=com

What will happen is all IPA users and groups will show up immediately, but the AD
users/groups won't until they are asked for (eg from a simple ldapsearch or
otherwise), which should (hopefully) be sufficient. In my previous cases of having to use
the compat tree, it was for legacy clients (eg BSD, Solaris/OmniOS/Illumos, and RHEL 5).

[Chris Dagdigian]

Replying to myself because I always post at odd hours when nobody is 
reading inbox, heh

Wondering if it is technically possible to use FreeIPA LDAP interface to 
resolve/authenticate AD-users.  Thanks!

Chris

>  Chris Dagdigian <mailto:[e-mail]>
>  October 26, 2020 at 2:31 PM
>  My use case on AWS involves ephemeral or auto-scaling servers that do 
>  not live long enough to justify a formal IPA enroll/un-enroll process.
>
>  We have a great AD-integrated IPA system running at the moment and 
>  I've been able to configure a light test client that trusts the IPA CA 
>  certificate and will become an LDAPS client of the FreeIPA server
>
>  This works great for local IPA users but I'm trying to think this 
>  through and I'm not sure if I can use LDAP to authenticate an AD user? 
>  Is this even possible?
>
>  This is my working sssd.conf for a test client that just uses LDAP -- 
>  works great for resolving users and groups that are local IPA users 
>  but so far I can't resolve any of the AD resident users:
>
>  [domain/default]
>  autofs_provider = ldap
>  cache_credentials = True
>  ldap_search_base = cn=users,cn=accounts,dc=ipa,dc=example,dc=com
>  ldap_group_search_base = cn=groups,cn=accounts,dc=ipa,dc=example,dc=com
>  id_provider = ldap
>  auth_provider = ldap
>  chpass_provider = ldap
>  ldap_uri = ldap://ipa001.ipa.example.com/
>  ldap_id_use_start_tls = True
>  ldap_tls_cacertdir = /etc/pki/tls/
>  default_shell = /bin/bash
>  override_shell = /bin/bash
>
>
>  Is there any method using ldap_search_base or an override of the 
>  Default Trust View that would allow me to deploy a client that only 
>  talks LDAP to FreeIPA but is able to resolve and authenticate AD 
>  users?  I'm wondering if this is even possible or if I'm looking at a 
>  lost cause. Thanks!
>
>  Chris
>
>