-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Trust samba ad #10
base: master
Are you sure you want to change the base?
Trust samba ad #10
Conversation
Refactor ipa-sam code to generate principals with additional POSIX information so that FreeIPA is capable to establish trust to Samba AD. Trust verification process from Samba AD DC side requires us to have a working local TDO object with POSIX attributes so that smbd would be able to map incoming authenticated Kerberos principal for the TDO to a local POSIX account. While Samba AD DC uses Kerberos to talk to us, its Kerberos ticket lacks MS-PAC information and Samba falls back to a direct getpwnam() call to verify that this user exists. Note that FreeIPA stores TDO objects in a subtree of cn=trusts,$SUFFIX and thus SSSD is not able to see these POSIX accounts unless specifically instructed to do so via multiple search bases.
This PR is being tested by PR-CI using the changes suggested here: freeipa/freeipa-pr-ci#259. |
@abbra As of today, freeipa/ipatests/test_integration/test_trust.py Lines 30 to 35 in 3337840
That freeipa/ipatests/pytest_ipa/integration/__init__.py Lines 218 to 226 in 3337840
However, on PR-CI we only have the AD (root) and the child hosts, to be able to execute the tests right now I'm pointing the |
Tree root domain is a domain that is part of the forest but is not subordinate in terms of DNS. Eg. if you have AD forest root |
@f-trivino, @netoarmando we need to have samba-client installed on the master -- without it all tests in
|
test