On Wed, 11 Sep 2013, kevint...@umac.mo wrote:
Dear all,

I am new to IPA and have some question about set up.
I already setup IPA server (CentOS 6.4 64bit), IPA client (CentOS 6.4
64bit), and Windows AD (Windows 2008 R2 Standard 64bit). IPA Server and
Windows AD already have 2-ways trusted. Windows AD user can logon under
IPA client PC.

I have 3 question about further setup.

1)  IPA Client Login issue.
In IPA client, if Windows AD user want to login, It need to type full name
such as 'userA@win_ad.com'. How do I let Windows AD user logon only with
their username? That means only use 'userA' to logon IPA Client PC rather
than 'userA@win_ad.com' ?
Not supported. There could be some obscure SSSD setting to allow one
SSSD domain (as in /etc/sss/sssd.conf) be default but since trusted AD
domains are represented as subdomains of a single IPA provider, full UPN is
used to distinguish and discover which subdomain they belong to for
performance reasons.

2) Windows Login issue.
I want to logon under Windows AD Client PC (Client PC's OS is Windows 7),
Since this Windows PC already join win_ad domain, it can allow Windows AD
domain user to logon. But when I try to logon IPA user, for example, logon
as 'userB@ipa_ad.com' or 'ipa_ad.com\userB'. It always show 'There are
currently no logon servers available to service the logon request.' and
does not allow IPA user to logon. How do I do now? I need to modify
Windows AD setting? or Windows client PC setting?
We do not support this mode yet, it requires implementation of Global
Catalog service on IPA side which is not done yet. Plans for doing that
are in Fedora 20-21 time frame.

3) Windows Login issue.
Can I login under Windows AD Client PC with IPA username only (not include
IPA domain)? that is, only use 'userB' as username to login?
No. Only users from the domain Windows PC is joined to could be logged
without explicit domain name. Since IPA domain belongs to a separate
forest, you cannot log in without explicit domain prefix. Please note, even
that will only be possible when we implement Global Catalog service on
IPA side.

/ Alexander Bokovoy

Freeipa-users mailing list

Reply via email to