Establishing trust with AD Domain
We can accomplish the trust by two methods. By running “trust-add” and enter the Admin password or using the secret method. Here we are using the “trust-add” method.
Once we run, the trusts relationship to “winlinuxsysadmins.local” will become ‘trusted’. It will prompt to enter the “Administrator” account password of the AD server.
# ipa trust-add --type=ad winlinuxsysadmins.local --admin Administrator --password

Now, IPA has created one-way forest trust on the IDM side. We have completed with a one-way trust. To verify from GUI navigate to IPA Server –> Trusts as shown in below picture.

By clicking on it will give more information about the windows trust.

Using Secret method
The above method can be followed or we have an alternative method using a secret. By using this method we don’t need to enter the Admin password. This will help in case we don’t have the Administrator access to the AD.
# ipa trust-add winlinuxsysadmins.local --trust-secret
Creating Trust in Active Directory
Then switch to Windows side and start creating trust, refer below snip.
In DNS Server Service Manager –> AD DS –> Active Directory Domains and Trust –> Right Click –> Properties –> Trust TAB –> “Domain that trust this domain (incoming trusts) { This will be already exists} –> Refresh
Note:> Here we need to keep in mind, only IDM needs to trust the AD for resolving all incoming request.

Fetch and find the trusted domain on IDM
Once the “linuxsyadmins.local” trusted by AD try to retrieve the list of trusted forest domain from the Active Directory.
# ipa trust-fetch-domains "winlinuxsysadmins.local"

Find the “winlinuxsysadmins.local” now we should get the domain information as follow.
# ipa trustdomain-find "winlinuxsysadmins.local"

To show all the available trust information we can use trust-show –all option with IPA command.
# ipa trust-show --all
Output for your reference
[root@idmns ~]# ipa trust-show --all Realm name: winlinuxsysadmins.local dn: cn=winlinuxsysadmins.local,cn=ad,cn=trusts,dc=linuxsysadmins,dc=local Realm name: winlinuxsysadmins.local Domain NetBIOS name: WINLINUXSYSADMI Domain Security Identifier: S-1-5-21-1731408719-2571748571-251808187 SID blacklist incoming: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2, S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7, S-1-5-8, S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12, S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16, S-1-5-17, S-1-5-18, S-1-5-19, S-1-5-20 SID blacklist outgoing: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2, S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7, S-1-5-8, S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12, S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16, S-1-5-17, S-1-5-18, S-1-5-19, S-1-5-20 Trust direction: Trusting forest Trust type: Active Directory domain gidnumber: 5001 ipantsecurityidentifier: S-1-5-21-479538025-3999940732-1828893943-1003 ipantsupportedencryptiontypes: 28 ipanttrustauthincoming: AQAAAAwAAAAcAQAAgElEMuUm1QECAAAAAAEAAGUAMwAyAEYAOAAhAGoAWAAyAEwAKABVADQALAAkADAAPwBtADMAOQBfAHUAbwBrAEAAYQA5AGMAUwAuAHUAagApADYALAA6AGYAPABQAEoAZgBEAEEAcQBHAGIAeABQAG4ANwBhAEUAeAAyAEMAZABLAE8AagA9ACYAfgB1AE0AXQBbAE4AdAA9ADsATgBGAGcAcwBAACYARQBaAHIAawAyAE4AdgBBAGkAbABJAFkAQABLAFYALQBjAHIATgBSAFsARgBLAFYANQBCADwAOwBuAFoAUQBqAGMAKAAuAG4ASQBPAGkAPgA9AFsASgBCAHUAdQAwACkAVwBwAFsAdwCASUQy5SbVAQIAAAAAAQAAZQAzADIARgA4ACEAagBYADIATAAoAFUANAAsACQAMAA/AG0AMwA5AF8AdQBvAGsAQABhADkAYwBTAC4AdQBqACkANgAsADoAZgA8AFAASgBmAEQAQQBxAEcAYgB4AFAAbgA3AGEARQB4ADIAQwBkAEsATwBqAD0AJgB+AHUATQBdAFsATgB0AD0AOwBOAEYAZwBzAEAAJgBFAFoAcgBrADIATgB2AEEAaQBsAEkAWQBAAEsAVgAtAGMAcgBOAFIAWwBGAEsAVgA1AEIAPAA7AG4AWgBRAGoAYwAoAC4AbgBJAE8AaQA+AD0AWwBKAEIAdQB1ADAAKQBXAHAAWwB3AA== ipanttrustauthoutgoing: AQAAAAwAAAAcAQAAgElEMuUm1QECAAAAAAEAAGUAMwAyAEYAOAAhAGoAWAAyAEwAKABVADQALAAkADAAPwBtADMAOQBfAHUAbwBrAEAAYQA5AGMAUwAuAHUAagApADYALAA6AGYAPABQAEoAZgBEAEEAcQBHAGIAeABQAG4ANwBhAEUAeAAyAEMAZABLAE8AagA9ACYAfgB1AE0AXQBbAE4AdAA9ADsATgBGAGcAcwBAACYARQBaAHIAawAyAE4AdgBBAGkAbABJAFkAQABLAFYALQBjAHIATgBSAFsARgBLAFYANQBCADwAOwBuAFoAUQBqAGMAKAAuAG4ASQBPAGkAPgA9AFsASgBCAHUAdQAwACkAVwBwAFsAdwCASUQy5SbVAQIAAAAAAQAAZQAzADIARgA4ACEAagBYADIATAAoAFUANAAsACQAMAA/AG0AMwA5AF8AdQBvAGsAQABhADkAYwBTAC4AdQBqACkANgAsADoAZgA8AFAASgBmAEQAQQBxAEcAYgB4AFAAbgA3AGEARQB4ADIAQwBkAEsATwBqAD0AJgB+AHUATQBdAFsATgB0AD0AOwBOAEYAZwBzAEAAJgBFAFoAcgBrADIATgB2AEEAaQBsAEkAWQBAAEsAVgAtAGMAcgBOAFIAWwBGAEsAVgA1AEIAPAA7AG4AWgBRAGoAYwAoAC4AbgBJAE8AaQA+AD0AWwBKAEIAdQB1ADAAKQBXAHAAWwB3AA== ipanttrustpartner: winlinuxsysadmins.local ipanttrustposixoffset: 0 objectclass: ipaNTTrustedDomain, ipaIDobject, top uidnumber: 5003 [root@idmns ~]#
Or to get only our added trust information to specify with a domain name by the following command.
# ipa trust-show winlinuxsysadmins.local
Less information for trust as shown below.
[root@idmns ~]# ipa trust-show winlinuxsysadmins.local Realm name: winlinuxsysadmins.local Domain NetBIOS name: WINLINUXSYSADMI Domain Security Identifier: S-1-5-21-1731408719-2571748571-251808187 Trust direction: Trusting forest Trust type: Active Directory domain [root@idmns ~]#
Verify AD admin privilege accounts on IDM
Almost most of the configurations are done let obtain a Kerberos ticket for win domains Administrator account. Enter the Administrator account password when prompt.
# kinit Administrator@winlinuxsysadmins.local
Output for your reference
[root@idmns ~]# kinit Administrator@winlinuxsysadmins.local Password for Administrator@winlinuxsysadmins.local: [root@idmns ~]#
List the obtained Kerberos ticket using klist command, Here we can find the Administrator has a valid kb ticket.
[root@idmns ~]# klist Ticket cache: KEYRING:persistent:0:krb_ccache_QKwQFhc Default principal: Administrator@WINLINUXSYSADMINS.LOCAL Valid starting Expires Service principal 06/20/19 03:45:21 06/20/19 13:45:21 krbtgt/WINLINUXSYSADMINS.LOCAL@WINLINUXSYSADMINS.LOCAL renew until 06/21/19 03:45:17 [root@idmns ~]#
Creating external Groups on IDM
To import all users from trusted AD to IDM we need to create external groups.
# ipa group-add --desc='WINLINUXSYSADMINS.local admins external map' winlinuxsysadmins.local_external --external # ipa group-add --desc='WINLINUXSYSADMINS.local admins' winlinuxsysadmins.local
Adding Users to an external group
Once completed with group add all the users to existing external group from the trusted domain by entering the null value while asking for user/group.
# ipa group-add-member WINLINUXSYSADMINS.local_external --external 'WINLINUXSYSADMINS\Domain Admins'
Leave user and group blank, Just press enter.
Verify all Accounts
Now it’s time to verify all accounts using “getent” command with option and argument by replacing our win domain.
# getent passwd Administrator@winlinuxsysadmins.local # getent passwd babin@winlinuxsysadmins.local # getent passwd lonston@winlinuxsysadmins.local
Below output for your reference
[root@idmns ~]# getent passwd Administrator@winlinuxsysadmins.local administrator@winlinuxsysadmins.local:*:916000500:916000500:Administrator:/home/winlinuxsysadmins.local/administrator: [root@idmns ~]# [root@idmns ~]# getent passwd babin@winlinuxsysadmins.local babin@winlinuxsysadmins.local:*:916001104:916001104:Bobin L.:/home/winlinuxsysadmins.local/babin: [root@idmns ~]# [root@idmns ~]# getent passwd lonston@winlinuxsysadmins.local lonston@winlinuxsysadmins.local:*:916001105:916001105:Lonston L.:/home/winlinuxsysadmins.local/lonston:
Adding external group to POSIX group
Now we required to allow admin users of “winlinuxsysadmins.local_external” with POSIX group.
# ipa group-add-member WINLINUXSYSADMINS.LOCAL --groups WINLINUXSYSADMINS.local_external
Output for reference
# ipa group-add-member WINLINUXSYSADMINS.LOCAL --groups WINLINUXSYSADMINS.local_external [root@idmns ~]# ipa group-add-member WINLINUXSYSADMINS.LOCAL --groups WINLINUXSYSADMINS.local_external Group name: winlinuxsysadmins.local Description: WINLINUXSYSADMINS.local admins GID: 5004 Member groups: winlinuxsysadmins.local_external Number of members added 1
That’s it now let’s verify the accounts.
Verify AD account logins
Quickly do an SSH and verify for all your AD accounts from IDM server.
# ssh babin@winlinuxsysadmins.local@192.168.107.100
SSH Session Successful.
[root@idmns ~]# ssh babin@winlinuxsysadmins.local@192.168.107.100 Password: Last login: Thu Jun 20 14:14:21 2019 from idmns.linuxsysadmins.local -sh-4.2$ -sh-4.2$ ls -lthra total 16K drwx--x--x 3 root root 19 Jun 20 14:13 .. -rw------- 1 babin@winlinuxsysadmins.local babin@winlinuxsysadmins.local 193 Jun 20 14:13 .bash_profile -rw------- 1 babin@winlinuxsysadmins.local babin@winlinuxsysadmins.local 18 Jun 20 14:13 .bash_logout -rw------- 1 babin@winlinuxsysadmins.local babin@winlinuxsysadmins.local 231 Jun 20 14:13 .bashrc drwx------ 2 babin@winlinuxsysadmins.local babin@winlinuxsysadmins.local 83 Jun 20 14:14 . -rw------- 1 babin@winlinuxsysadmins.local babin@winlinuxsysadmins.local 45 Jun 20 14:14 .bash_history -sh-4.2$
That’s it we are good with all the above steps according to SSH sessions worked. Hence, this guide is too long in our upcoming guide, we will cover with the client setup.
By following below URL, Start setting up Client-side configuration
Setup a Linux server as IDM client to authenticate with Active Directory
Conclusion
Integrating IDM with AD cross-forest trust setup using IDM has a lot of features, will cover up with more topics on IDM. Your comments are most welcome, in case any update/improvement required in topic kindly let us know through comments. Subscribe to our newsletter to stay with us for more nix guides.