[Freeipa-users] Winsync

Hi! Is syncing (winsync) users and passwords from MS Active Directory deprecated in FreeIPA 4.x? If not, is there some documentation on how to use it? Additionaly, when using FreeIPA - AD trust, is it possible for user from trusted domain to log on to FreeIPA web UI? Thanks! -- Manage your

Re: [Freeipa-users] Winsync

oko...@redhat.com> wrote: > On Tue, 27 Oct 2015, Tomas Babej wrote: > >> >> >> On 10/27/2015 05:51 PM, Srdjan Dutina wrote: >> >>> Hi! >>> >>> >> Hello Srdjan, >> >> Is syncing (winsync) users and passwords from MS Active Direct

[Freeipa-users] FreeIPA with third-party wildcard certificate

Hi! I'm testing FreeIPA 4.1.0 on Centos 7 (1503). I have a *wildcard *certificate for my domain issued by GoDaddy. Could I use it with FreeIPA primary and replica servers instead of self-signed certificate? If yes, how could I replace the self-signed certificate in existing two servers

Re: [Freeipa-users] HBAC and SUDO rules for legacy clients

Yes, it does. Thank you. On Mon, Apr 20, 2015 at 6:08 PM Srdjan Dutina sdut...@gmail.com wrote: Sorry for misunderstanding. I understand HBAC rules will not work for Centos 5. I just wanted to make sure disabling allow all rule and adding new HBAC rules won't interfere with AD users logging

Re: [Freeipa-users] HBAC and SUDO rules for legacy clients

Apr 2015, Srdjan Dutina wrote: Hi, Testing FreeIPA 4.1.0 (Centos 7 (1503)) with AD 2012 R2 trust. For Centos 5.11 Client (SSSD 1.5.1), will HBAC and SUDO rules function? If yes, does this apply AD users also? SSSD 1.5.1 does not have SUDO support. HBAC support in 1.5.1 will mot likely

[Freeipa-users] HBAC and SUDO rules for legacy clients

Hi, Testing FreeIPA 4.1.0 (Centos 7 (1503)) with AD 2012 R2 trust. For Centos 5.11 Client (SSSD 1.5.1), will HBAC and SUDO rules function? If yes, does this apply AD users also? Thank you! -- Manage your subscription for the Freeipa-users mailing list:

Re: [Freeipa-users] HBAC and SUDO rules for legacy clients

also and how could I do this? On Mon, Apr 20, 2015 at 4:51 PM Alexander Bokovoy aboko...@redhat.com wrote: On Mon, 20 Apr 2015, Srdjan Dutina wrote: Thank for quick answer! If I disable HBAC rule, I can still login to Centos 5 client using IPA user, but not using AD user. Is there a workaround

Re: [Freeipa-users] HBAC and SUDO rules for legacy clients

, 20 Apr 2015, Srdjan Dutina wrote: Just found in http://www.freeipa.org/images/0/0d/FreeIPA33-legacy-clients.pdf the next sentence: If you have HBAC's allow_all rule disabled, you will need to allow system-auth service on the FreeIPA master, so that authentication of the AD users can

[Freeipa-users] FreeIPA with Active directory Read-only domain controller trust setup

Hi, I'm testing FreeIPA (v4.1.3, Centos 7) - AD (2012 R2) trust on branch site where only AD read-only domain controller (RODC) exists. I'm aware that for initial establishing of trust I need access to writable domain controller so IPA can add trust to AD domains and trusts. But after initial

Re: [Freeipa-users] Active Directory Kerberos authentication on older versions of IPA clients

Hi Jakub, Thanks for quick response. Yes, there were acting up. I tried to configure them the other day but obviously misconfigured something. Thanks again! -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to

[Freeipa-users] Active Directory Kerberos authentication on older versions of IPA clients

Hi, I created the following test environment: 1. IPA server: v4.1.3 on Centos 7 2. Two-way trust with Active directory domain - Windows server 2012 R2 3. Connected multiple IPA clients: - Fedora 21 - v4.1.3 - Centos 7 - v3.3.3 - Centos 6.6 v.3.0.0 to IPA domain. Using Kerberos ticket for AD