Ñò
ìÿÒXc @ s) d d k Td d k l Z d d k l Z l Z l Z l Z l Z l Z l
Z
l Z d d k l
Z
d d k l Z d d k l Z d d k l Z d d k l Z y d d k Z e Z Wn e j
o Z e Z n Xe i i oI e i i d4 j o6 y d d k Z e Z Wq.e j
o
e Z q.Xn e d ƒ Z e d
d e d ƒ ƒe d d e d ƒ ƒe d d e d ƒ ƒe d d e d ƒ ƒe d d e d ƒ ƒf Z! h e d ƒ d 6e d ƒ d 6e d ƒ d 6Z" h e d ƒ d 6e d ƒ d 6e d ƒ d 6Z# h e d! ƒ e 6e d" ƒ e 6Z$ e d# ƒ Z% d$ „ Z& d% „ Z' d& „ Z( d' e) f d( „ ƒ YZ* d) „ Z+ d* e, f d+ „ ƒ YZ- d, e. f d- „ ƒ YZ/ d. e0 f d/ „ ƒ YZ1 d0 e2 f d1 „ ƒ YZ3 d2 e4 f d3 „ ƒ YZ5 e i6 e* ƒ e i6 e- ƒ e i6 e1 ƒ e i6 e/ ƒ e i6 e3 ƒ e i6 e5 ƒ d S(5 iÿÿÿÿ( t *( t dns_container_exists( t apit Strt StrEnumt Passwordt DefaultFromt _t ngettextt Object( t Enum( t Command( t errors( t ipautil( t utilNt litet servers½
Cross-realm trusts
Manage trust relationship between IPA and Active Directory domains.
In order to allow users from a remote domain to access resources in IPA
domain, trust relationship needs to be established. Currently IPA supports
only trusts between IPA and Active Directory domains under control of Windows
Server 2008 or later, with functional level 2008 or later.
Please note that DNS on both IPA and Active Directory domain sides should be
configured properly to discover each other. Trust relationship relies on
ability to discover special resources in the other domain via DNS records.
Examples:
1. Establish cross-realm trust with Active Directory using AD administrator
credentials:
ipa trust-add --type=ad --admin --password
2. List all existing trust relationships:
ipa trust-find
3. Show details of the specific trust relationship:
ipa trust-show
4. Delete existing trust relationship:
ipa trust-del
Once trust relationship is established, remote users will need to be mapped
to local POSIX groups in order to actually use IPA resources. The mapping should
be done via use of external membership of non-POSIX group and then this group
should be included into one of local POSIX groups.
Example:
1. Create group for the trusted domain admins' mapping and their local POSIX group:
ipa group-add --desc=' admins external map' ad_admins_external --external
ipa group-add --desc=' admins' ad_admins
2. Add security identifier of Domain Admins of the to the ad_admins_external
group:
ipa group-add-member ad_admins_external --external 'AD\Domain Admins'
3. Allow members of ad_admins_external group to be associated with ad_admins POSIX group:
ipa group-add-member ad_admins --groups ad_admins_external
4. List members of external members of ad_admins_external group to see their SIDs:
ipa group-show ad_admins_external
t
ipantflatnamet labels Domain NetBIOS namet ipanttrusteddomainsids Domain Security Identifiert trustdirections Trust directiont trusttypes
Trust typet truststatuss Trust statuss Non-Active Directory domaini s Active Directory domaini s RFC4120-compliant Kerberos realmi s Trusting forests Trusted forests
Two-way trusts Established and verifieds' Waiting for confirmation by remote sidet Unknownc C s" t i t | ƒ t ƒ } t | ƒ S( sä
Returns a string representing a type of the trust. The original field is an enum:
LSA_TRUST_TYPE_DOWNLEVEL = 0x00000001,
LSA_TRUST_TYPE_UPLEVEL = 0x00000002,
LSA_TRUST_TYPE_MIT = 0x00000003
( t _trust_type_dictt gett intt _trust_type_dict_unknownt unicode( t levelt string( ( s8 /usr/lib/python2.6/site-packages/ipalib/plugins/trust.pyt trust_type_string{ s c C s" t i t | ƒ t ƒ } t | ƒ S( sÙ
Returns a string representing a direction of the trust. The original field is a bitmask taking two bits in use
LSA_TRUST_DIRECTION_INBOUND = 0x00000001,
LSA_TRUST_DIRECTION_OUTBOUND = 0x00000002
( t _trust_direction_dictR R R R ( R R ( ( s8 /usr/lib/python2.6/site-packages/ipalib/plugins/trust.pyt trust_direction_string… s c C s t i | t ƒ } t | ƒ S( N( t _trust_status_dictR R R ( R R ( ( s8 /usr/lib/python2.6/site-packages/ipalib/plugins/trust.pyt trust_status_stringŽ s t trustc B s¼ e Z d Z d Z e i i Z e d ƒ Z e d ƒ Z
d g Z d d d d d
d d d
d d d d g Z d d d d g Z
e d ƒ Z e d ƒ Z e d d d d e d ƒ d e ƒf Z RS( s
Trust object.
t adt ipaR$ t trustst ipaNTTrustedDomaint cnR R t ipanttrusttypet ipanttrustattributest ipanttrustdirectiont ipanttrustpartnert ipantauthtrustoutgoingt ipanttrustauthincomingt ipanttrustforesttrustinfot ipanttrustposixoffsett ipantsupportedencryptiontypest Trustst Trustt cli_namet realmR s
Realm namet primary_key( R% R& ( t __name__t
__module__t __doc__t trust_typesR t envt container_trustst container_dnR t object_namet object_name_pluralt object_classt default_attributest search_display_attributesR t label_singularR t Truet takes_params( ( ( s8 /usr/lib/python2.6/site-packages/ipalib/plugins/trust.pyR$ ’ s$ c C s[ t | t ƒ p t ‚ | t i j o0 t d | f | i | i ƒ } t | d | ƒ S| S( NR) i ( t
isinstancet DNt AssertionErrorR$ R; R= t basedn( R< t
trust_typet dnR> ( ( s8 /usr/lib/python2.6/site-packages/ipalib/plugins/trust.pyt
make_trust_dn s
t trust_addc B s< e Z e d ƒ Z e i e d d d d e d ƒ d d" d d d e ƒe d
d d d e d ƒ ƒe d
d d d e d ƒ d e
ƒe d d d d e d ƒ ƒe d d d d e d ƒ d e
ƒe d d d d e d ƒ ƒe d d d d e d ƒ d d d e ƒf Z e d ƒ Z e i
e Z
d „ Z d „ Z d! „ Z RS(# s
Add new trust to use.
This command establishes trust relationship to another domain
which becomes 'trusted'. As result, users of the trusted domain
may access resources of this domain.
Only trusts to Active Directory domains are supported right now.
The command can be safely run multiple times against the same domain,
this will cause change to trust relationship credentials on both
sides.
RK R5 t typeR s- Trust type (ad for Active Directory, default)t valuesu adt defaultt autofills realm_admin?t admins% Active Directory domain administrators
realm_passwd?t passwords0 Active directory domain administrator's passwordt confirms
realm_server?R s< Domain controller for the Active Directory domain (optional)s
trust_secret?t trust_secrets Shared secret for the trusts base_id?t base_ids; First Posix ID of the range reserved for the trusted domains range_size?t
range_sizes4 Size of the ID range reserved for the trusted domaini@
s2 Added Active Directory trust for realm "%(value)s"c O sŒ t o5 d | j o( t i d t d ƒ d t d ƒ ƒ ‚ n d | j oO | d d j o | i | | Ž } q± t i d t d ƒ d t d ƒ ƒ ‚ n t i d t d ƒ ƒ ‚ | i | | Ž d
| d } | i i } | i d t
t i i
t i i ƒ d
| ƒ \ } } | d d | d sn
:
9
Ô