[Freeipa-users] Odd behavior with groups in compat tree

2017-05-25 Thread Robert Johnson via FreeIPA-users
Red Hat Enterprise Linux Server release 7.3 ipa-server-4.4.0-14.el7_3.4.x86_64 389-ds-base-1.3.5.10-15.el7_3.x86_64 sssd-1.14.0-43.el7_3.11.x86_64 I have noticed some odd behavior when I perform ldap searches in the compat tree for groups. I have approximately 20 posix groups including the defaul

[Freeipa-users] Compat tree question

2017-05-30 Thread Robert Johnson via FreeIPA-users
Red Hat Enterprise Linux Server release 7.3 ipa-server-4.4.0-14.el7_3.4.x86_64 389-ds-base-1.3.5.10-15.el7_3.x86_64 sssd-1.14.0-43.el7_3.11.x86_64 When looking at entries in the "cn=groups,cn=compat" tree, I noticed that the entries for windows groups have the realm portion of the group name in al

[Freeipa-users] Re: Compat tree question

2017-05-30 Thread Robert Johnson via FreeIPA-users
orted. I can reproduce this easily. Robert Johnson On Tue, May 30, 2017 at 1:10 PM, Alexander Bokovoy wrote: > On ti, 30 touko 2017, Robert Johnson via FreeIPA-users wrote: > >> Red Hat Enterprise Linux Server release 7.3 >> ipa-server-4.4.0-14.el7_3.4.x86_64 >> 38

[Freeipa-users] Re: Compat tree question

2017-05-30 Thread Robert Johnson via FreeIPA-users
Is there a option in SSSD or the plugin to turn off the normalization ? On Tue, May 30, 2017 at 2:27 PM, Alexander Bokovoy wrote: > On ti, 30 touko 2017, Robert Johnson via FreeIPA-users wrote: > >> So I took a brand new user that I have never used in the system before (I >>

[Freeipa-users] Re: GSSAPI login from trusted AD domain to FreeIPA clients not working

2017-06-20 Thread Robert Johnson via FreeIPA-users
I ran into this exact same problem with my IPA domain in a one way external trust to our Windows 2012 R2 AD forest. It appears that Microsoft may have removed the routing suffix option from the Windows 2012 R2 native forest trust gui. My solution was to follow the instructions in the "Define host

[Freeipa-users] Re: GSSAPI login from trusted AD domain to FreeIPA clients not working

2017-06-21 Thread Robert Johnson via FreeIPA-users
For what its worth, I dug through my emails with Red Hat tech support and this is what we got back from the Identity Management support team: --- I did some additional research and found another customer which had a similar issue - our IPA development team has added some additional comment