Hey All,

I've successfully mapped the nixadmins to the external group nixadmins_external. However no users in that group make it over to Free IPA that I can see.


ipa group-add-member nixadmins_external --external "nixadmins"

Windows AD users, 3 of them, are in the windows AD group nixadmins. However I can't port them over.

These accounts have UNIX attributes assigned to them.

Question that I have and can't find, should I be seeing these users in the mapped groups above? ( ie within the GUI should I see any users listed from AD DC in nixadmins or nixadmins_external? )

If there is an issue and I'm just not picking it out from the debug logs, what to look for? Is there anything more I need to do on the Windows side that I haven't found on the existing pages?


# ipa group-add-member nixadmins_external --external "nixadmins"
[member user]:
[member group]:
  Group name: nixadmins_external
  Description: NIX Admins External map
  External member: S-1-5-21-3418825849-1633701630-2291579631-1006
  Member groups: nixadmins
  Member of groups: nixadmins
  Indirect Member groups: nixadmins_external
-------------------------
Number of members added 1
-------------------------
#


# ipa trustdomain-find abc.xyz
  Domain name: abc.xyz
  Domain NetBIOS name: ABC
  Domain Security Identifier: S-1-5-21-1803828911-4163023034-2461700517
  Domain enabled: True
----------------------------
Number of entries returned 1
----------------------------
#


[realms]
 DOM.ABC.XYZ = {
.
.
.
  auth_to_local = RULE:[1:$1@$0](^.*@ABC.XYZ$)s/@ABC.XYZ/@abc.xyz/
  auth_to_local = DEFAULT
}


# ipa trust-fetch-domains abc.xyz
----------------------------------------------------------------------------------------
List of trust domains successfully refreshed. Use trustdomain-find command to list them.
----------------------------------------------------------------------------------------
----------------------------
Number of entries returned 0
----------------------------
[root@idmipa01 sssd]# ipa trustdomain-find abc.xyz
  Domain name: abc.xyz
  Domain NetBIOS name: ABC
  Domain Security Identifier: S-1-5-21-1803828911-4163023034-2461700517
  Domain enabled: True
----------------------------
Number of entries returned 1
----------------------------


# ipa trust-fetch-domains abc.xyz
----------------------------------------------------------------------------------------
List of trust domains successfully refreshed. Use trustdomain-find command to list them.
----------------------------------------------------------------------------------------
----------------------------
Number of entries returned 0
----------------------------
#


The following command successfully returns all AD objects under the Users cn.

# ldapsearch -x -h 192.168.0.3 -D "t...@abc.xyz" -W -b "cn=users,dc=abc,dc=xyz" -s sub "(cn=*)" cn mail sn


--
Cheers,
Tom K.
-------------------------------------------------------------------------------------

Living on earth is expensive, but it includes a free trip around the sun.

--
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project
  • ... TomK
    • ... Sumit Bose
      • ... TomK
        • ... TomK
          • ... TomK
            • ... Alexander Bokovoy
              • ... TomK
                • ... List dedicated to discussions about use, configuration and deployment of the IPA server.
                • ... List dedicated to discussions about use, configuration and deployment of the IPA server.
                • ... TomK
                • ... TomK

Reply via email to