ipa-adtrust-install(1) IPA Manual Pages ipa-adtrust-install(1)NAMEipa-adtrust-install - Prepare an IPA server to be able to establish
trust relationships with AD domains
SYNOPSISipa-adtrust-install [OPTION]...
DESCRIPTION
Adds all necessary objects and configuration to allow an IPA server to
create a trust to an Active Directory domain. This requires that the
IPA server is already installed and configured.
Please note you will not be able to estabilish an trust to an Active
Directory domain unless the realm name of the IPA server matches its
domain name.
ipa-adtrust-install can be run multiple times to reinstall deleted
objects or broken configuration files. E.g. a fresh samba configuration
(smb.conf file and registry based configuration can be created. Other
items like e.g. the configuration of the local range cannot be changed
by running ipa-adtrust-install a second time because with changes here
other objects might be affected as well.
OPTIONS-d, --debug
Enable debug logging when more verbose output is needed
--ip-address=IP_ADDRESS
The IP address of the IPA server. If not provided then this is
determined based on the hostname of the server.
--netbios-name=NETBIOS_NAME
The NetBIOS name for the IPA domain. If not provided then this
is determined based on the leading component of the DNS domain
name. Running ipa-adtrust-install for a second time with a dif‐
ferent NetBIOS name will change the name. Please note that
changing the NetBIOS name might break existing trust relation‐
ships to other domains.
--no-msdcs
Do not create DNS service records for Windows in managed DNS
server. Since those DNS service records are the only way to dis‐
cover domain controllers of other domains they must be added
manually to a different DNS server to allow trust realationships
work properly. All needed service records are listed when
ipa-adtrust-install finishes and either --no-msdcs was given or
no IPA DNS service is configured. Typically service records for
the following service names are needed for the IPA domain which
should point to all IPA servers:
· _ldap._tcp
· _kerberos._tcp
· _kerberos._udp
· _ldap._tcp.dc._msdcs
· _kerberos._tcp.dc._msdcs
· _kerberos._udp.dc._msdcs
· _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs
· _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs
· _kerberos._udp.Default-First-Site-Name._sites.dc._msdcs
--add-sids
Add SIDs to existing users and groups as a final step of the
ipa-adtrust-install run. If there a many existing users and
groups and a couple of replicas in the environment this opera‐
tion might lead to a high replication traffic and a performance
degradation of all IPA servers in the environment. To avoid this
the SID generation can be run after ipa-adtrust-install is run
and scheduled independently. To start this task you have to load
an edited version of ipa-sidgen-task-run.ldif with the ldapmod‐
ify command info the directory server.
-U, --unattended
An unattended installation that will never prompt for user input
-U, --rid-base=RID_BASE
First RID value of the local domain. The first Posix ID of the
local domain will be assigned to this RID, the second to RID+1
etc. See the online help of the idrange CLI for details.
-U, --secondary-rid-base=SECONDARY_RID_BASE
Start value of the secondary RID range, which is only used in
the case a user and a group share numerically the same Posix ID.
See the online help of the idrange CLI for details.
-A, --admin-name=ADMIN_NAME
The name of the user with administrative privileges for this IPA
server. Defaults to 'admin'.
-a, --admin-password=password
The password of the user with administrative privileges for this
IPA server. Will be asked interactively if -U is not specified.
The credentials of the admin user will be used to obtain Kerberos
ticket before configuring cross-realm trusts support and afterwards, to
ensure that the ticket contains MS-PAC information required to actually
add a trust with Active Directory domain via 'ipa trust-add --type=ad'
command.
--enable-compat
Enables support for trusted domains users for old clients
through Schema Compatibility plugin. SSSD supports trusted
domains natively starting with version 1.9. For platforms that
lack SSSD or run older SSSD version one needs to use this
option. When enabled, slapi-nis package needs to be installed
and schema-compat-plugin will be configured to provide lookup of
users and groups from trusted domains via SSSD on IPA server.
These users and groups will be available under cn=users,cn=com‐
pat,$SUFFIX and cn=groups,cn=compat,$SUFFIX trees. SSSD will
normalize names of users and groups to lower case.
In addition to providing these users and groups through the com‐
pat tree, this option enables authentication over LDAP for
trusted domain users with DN under compat tree, i.e. using bind
DN uid=administrator@ad.domain,cn=users,cn=compat,$SUFFIX.
LDAP authentication performed by the compat tree is done via PAM
'system-auth' service. This service exists by default on Linux
systems and is provided by pam package as /etc/pam.d/sys‐
tem-auth. If your IPA install does not have default HBAC rule
'allow_all' enabled, then make sure to define in IPA special
service called 'system-auth' and create an HBAC rule to allow
access to anyone to this rule on IPA masters.
As 'system-auth' PAM service is not used directly by any other
application, it is safe to use it for trusted domain users via
compatibility path.
EXIT STATUS
0 if the installation was successful
1 if an error occurred
IPA Aug 23 2011 ipa-adtrust-install(1)
