On Fri, 2016-05-13 at 15:14 +0200, Sumit Bose wrote: > On Wed, May 11, 2016 at 05:17:03PM +0100, lejeczek wrote: > > .. if possible, would you know? > > hi everybody, > > I'm trying, and hoping it is possible to realm join an AD but is > > such a > > way so I tap my IPA into specific OU within that AD. > > I'm not exactly sure what you mean here. Do you want to join a > computer > which is already a client in an IPA domain to AD as well? If this is > the > case I would recommend to consider the IPA trust feature. Joining 2 > domain is in general possible with SSSD but has to be done with very > great care, e.g. by using different keytabs for each domain. Can IPA domain establish a trust between win AD if IPA admin only has admin control over an OU in win AD ? I know very little about AD and only started with IPA - I don't suppose control of OU delegated to a user makes that user AD admin. I guess what I'm thinking, asking, is - what would be the correct possible way to plug in, connect IPA domain to win AD when one has admin control only over a OU in win AD? many thanks L. > > > > The thing is - I'm thinking it would make user access control ideal > > from the start as I need only users from that OU, but also because I'm > > only granted access to the user/group who has control over that OU. > > I'm trying that but I see: > > > > ! The computer account RIDER already exists, but is not in the desired > > organizational unit. > > adcli: joining domain ccc.bb.aa failed: The computer account RIDER > > already exists, > >
> > > Computer account names in AD must be unique even if they are added to > different OUs. So if there is already a computer called RIDER joined to > AD and it is not your computer you have to rename your computer to join. > If it is your computer and you want to create it in a different OU you > have to delete to old computer object first and then do a fresh join. > > HTH > > bye, > Sumit > > > > > > ! Failed to join the domain > > > > I'm doing this: > > $ realm join ccc.bb.aa --user=private-user --computer-ou=private > > > > and computer is in OU=private of ccc.bb.aa > > so is the user private-user > > > > many thanks. > > L##SELECTION_END## > > > > > > > > > -- > > Manage your subscription for the Freeipa-users mailing list: > > https://www.redhat.com/mailman/listinfo/freeipa-users > > > > Go to http://freeipa.org for more info on the project > > for more info on the project > > > > >
-- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project