From Fedora Project Wiki
(Moved to FeatureReadyForFesco for approval (#1011))
(Feature accepted on Jan 30 FESCo meeting (#1011))
Line 80: Line 80:




[[Category:FeatureReadyForFesco]]
[[Category:FeatureAcceptedF19]]
<!-- When your feature page is completed and ready for review -->
<!-- When your feature page is completed and ready for review -->
<!-- remove Category:FeaturePageIncomplete and change it to Category:FeatureReadyForWrangler -->
<!-- remove Category:FeaturePageIncomplete and change it to Category:FeatureReadyForWrangler -->
<!-- After review, the feature wrangler will move your page to Category:FeatureReadyForFesco... if it still needs more work it will move back to Category:FeaturePageIncomplete-->
<!-- After review, the feature wrangler will move your page to Category:FeatureReadyForFesco... if it still needs more work it will move back to Category:FeaturePageIncomplete-->
<!-- A pretty picture of the page category usage is at: https://fedoraproject.org/wiki/Features/Policy/Process -->
<!-- A pretty picture of the page category usage is at: https://fedoraproject.org/wiki/Features/Policy/Process -->

Revision as of 18:27, 30 January 2013


FreeIPA v3 Trust Improvements

Summary

Multiple Domain Controllers and multiple additional DNS domains managed by FreeIPA can now be accessible via trusting relationship by Active Directory domain members. Additionally, Global Catalog service is provided for use by AD clients, allowing FreeIPA users to be included into access-control lists of AD resources.

Owner

  • Email: abokovoy@redhat.com

Current status

  • Targeted release: Fedora 19
  • Last updated: 2013-01-16
  • Percentage of completion: 50%

Detailed Description

In Fedora 18 only a single designated Domain Controller in FreeIPA realm is supported for interoperability with Active Directory and only a primary DNS domain associated with the FreeIPA realm is advertised to the trusted party. With the changes coming in future FreeIPA release, support for multiple domain controllers per FreeIPA realm and multiple DNS domain suffixes associated with the realm will be available. FreeIPA will also provide Global Catalog service implementation which is key feature to allow discretionary access to Active Directory resources for FreeIPA users --- making possible, for example, interactive logon to Windows machines under a FreeIPA identity.

Benefit to Fedora

System administrators, using FreeIPA in Fedora 19, will get access to resources in trusted Active Directory domains. Active Directory domain administrators will be able to authorize access to their machines, services, and applications for FreeIPA-managed users and groups, giving practical bi-directional interoperability.

Scope

The work is done in the scope of FreeIPA upstream development. List of development tasks is available here. Additional capabilities are provided as part of SSSD upstream development, designed and tracked here

How To Test

Test instructions for trust feature are available at http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup and will extended to cover multi-DC configuration and extended access controls when accessing Windows machines

User Experience

FreeIPA-managed users will be able to log-in interactively to Windows machines in a trusted Active Directory domain. FreeIPA administrators will be able to configure multiple domain controllers and multiple DNS domain suffixes visible to a trusted Active Directory domain.

Dependencies

Contingency Plan

Feature implementation affects FreeIPA and SSSD. If SSSD part is not implemented in time, this feature is not delivered. There is no effects otherwise, previous behaviour is retained. Same goes for FreeIPA. Other parts of Fedora are not affected.

Documentation

Release Notes

  • When using FreeIPA to trust Active Directory domain, it is now possible to designate multiple domain controllers in FreeIPA to serve Windows clients.
  • FreeIPA adds management of additional domain suffixes visible to trusted Active Directory domain's clients.
  • FreeIPA now implements Global Catalog service to allow Active Directory domain administrators grant access to their resources to FreeIPA users.

Comments and Discussion