[Freeipa-users] sssd compatibility with older RHEL 6 minor releases.
Hello all. The environment i'm currently working to migrate under IPA identity management contains mostly RHEL 6.2 servers. I'm planing to use Active Directory Cross Forest Trust for Identities, IPA as sudo provider, and all the other goodies that IPA provides. If i want to enjoy all the new features (at least most of them), i know that clients have to be sssd version 1.9. And if i want IPA to be auto configured as sudo provider it has to be sssd 1.11. When reading the mailing list i noticed that sssd 1.11 is mentioned as feature of rhel 6.6. What i would like and understand is what could go wrong if i will install sssd 1.11 on rhel 6.2 servers.And what is is your general recommendations for older RHEL 6 (minor) releases? Thanks in advance, Genadi. -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go To http://freeipa.org for more info on the project
Re: [Freeipa-users] sssd compatibility with older RHEL 6 minor releases.
On 01/31/2015 01:37 PM, Genadi Postrilko wrote: Hello all. The environment i'm currently working to migrate under IPA identity management contains mostly RHEL 6.2 servers. I'm planing to use Active Directory Cross Forest Trust for Identities, IPA as sudo provider, and all the other goodies that IPA provides. If i want to enjoy all the new features (at least most of them), i know that clients have to be sssd version 1.9. And if i want IPA to be auto configured as sudo provider it has to be sssd 1.11. When reading the mailing list i noticed that sssd 1.11 is mentioned as feature of rhel 6.6. What i would like and understand is what could go wrong if i will install sssd 1.11 on rhel 6.2 servers.And what is is your general recommendations for older RHEL 6 (minor) releases? It will pull a lot of dependencies and most of your system will look like 6.6 system Also the upgrade like this might reveal some issues as the upgrades are expected to be gradual. 1-2 versions is ok but 4 is quit a big leap. Overall it is a bit risky to do it. You have three options: - upgrade properly but probably in two steps 6.2 - 6.4 - 6.6 - use SSSD from 6.2 as is for now. It will have limited functionality but can leverage AD users from the trust. You would need to configure SSSD to use LDAP for authentication and point to compat tree of IPA to take advantage of the trust. See details here: http://www.freeipa.org/images/0/0d/FreeIPA33-legacy-clients.pdf - take your chances and try a hybrid you propose but it is not a formally supported configuration. Thanks in advance, Genadi. -- Thank you, Dmitri Pal Sr. Engineering Manager IdM portfolio Red Hat, Inc. -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go To http://freeipa.org for more info on the project
[Freeipa-users] IPA-adtrust and addition of replicas
Hi, I have a single master instance of IPA 3.3.5 at the moment. I have configured this with IPA adtrust and run the adtrust preparation. I am about to add a second replica. The documentation[0][1] doesn't really go into what happens in this circumstance. Do I need to make any configuration on the replica once I have installed it? Or does the replica information file hint to the ipa-replica-installer that adtrust components must be configured? IE can my new replica act as a trust master, and will it correctly update attributes such as iPAntpassword? Sincerely, William [0] http://www.freeipa.org/page/V3/MultipleTrustServers [1] https://fedorahosted.org/freeipa/ticket/2189 -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go To http://freeipa.org for more info on the project