On Tue, 18 Sep 2012, Petr Vobornik wrote:
On 09/18/2012 02:15 PM, Sumit Bose wrote:
On Tue, Sep 18, 2012 at 12:42:49PM +0200, Sumit Bose wrote:
On Mon, Sep 17, 2012 at 06:44:36PM +0300, Alexander Bokovoy wrote:

Following patch adds trust verification sequence to the case when we
establish trust with knowledge of AD administrative credentials.

As we found out, in order to validate/verify trust, one has to have
administrative credentials for the trusted domain, since there are
few RPCs that should be performed against trusted domain's DC's LSA
and NetLogon pipes and these are protected by administrative credentials.

Thus, when we know admin credentials for the remote domain, we can
perform the trust validation.


Just a short feedback. The patch is working as expected, for a newly
created trust Windows will send a TGS request to the IPA KDC without
explicit validation on the windows side. Currently I have some issues
in my test setup so that I can not give a full ACK atm.

ok, ACK.

Nevertheless it would be nice if Petr can check for any implications to
the web UI with respect to the status of the trust.

It shouldn't break Web UI but Web UI won't use it. In add command Web UI uses only the command state (success/error). If the truststatus text would be a part of command summary text, it can be displayed in notification message (which fades after 3s) when comment 8 of https://fedorahosted.org/freeipa/ticket/2977#comment:8 is implemented.
It is displayed as part of the output, truststatus property:
# ipa trust-add --type=ad --admin Administrator@ad.local --password ad.local
Active directory domain adminstrator's password: -------------------------------------------------
Added Active Directory trust for realm "ad.local"
  Realm name: ad.local
  Domain NetBIOS name: AD
  Domain Security Identifier: S-1-5-21-16904141-148189700-2149043814
  Trust direction: Two-way trust
  Trust type: Active Directory domain
  Trust status: Established and verified

Would be good if you could take it in use.
It would be nice if it can be saved to ldap and return in show/find commands? That way we can show it in search or details page. Or we can implement trust-status $TRUST --admin $ADMIN --$password $PASSWORD command to check the actual status anytime in a future.
We don't have an attribute to store the status. Neither it exists in Windows.

I'll talk to Simo if we can have one attribute like that but the price
of maintaining it up to date might be too much. On the other hand, we
can always invalidate value in the attribute when ipasam cannot use
shared trust account against trusted domain...

Running validation/verification as a separate command is possible but it
would be relatively resource-hungry and makes little use on its own. We may couple it together with future multiple suffixes support (tickets
#2848, #2593) as fetching additional suffixes depends on validated trust

/ Alexander Bokovoy

Freeipa-devel mailing list

Reply via email to