From Fedora Project Wiki

(Updating page to remove wbinfo references and other outdated steps)
 
(One intermediate revision by one other user not shown)
Line 5: Line 5:
 
It should be noted that this is a simplified version of the following:
 
It should be noted that this is a simplified version of the following:
 
[[QA:Testcase_freeipav3_ad_trust]]
 
[[QA:Testcase_freeipav3_ad_trust]]
 +
 +
For more information on FreeIPA Trust support, see the official guide here:
 +
[http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup IPAv3_AD_trust_setup]
  
 
|setup=
 
|setup=
Line 19: Line 22:
  
 
1. On ipa1 and ipa2: Install FreeIPA AD Trust related software
 
1. On ipa1 and ipa2: Install FreeIPA AD Trust related software
     # yum install freeipa-server-trust-ad samba-winbind samba-winbind-clients samba-client
+
     # yum install freeipa-server-trust-ad
  
 
2. On ipa1: Setup IPA AD Trust with ipa-adtrust-install command
 
2. On ipa1: Setup IPA AD Trust with ipa-adtrust-install command
Line 25: Line 28:
 
     Prompts should provide the auto-discovered values.  Accept defaults.
 
     Prompts should provide the auto-discovered values.  Accept defaults.
  
2.5. Wait until replication happens... Should take not more than few minutes.
+
3. Wait until replication happens... Should take not more than few minutes.
  
3. On ipa2:  Setup IPA AD Trust with ipa-adtrust-install command
+
4. On ipa2:  Setup IPA AD Trust with ipa-adtrust-install command
 
     # ipa-adtrust-install
 
     # ipa-adtrust-install
 
     Prompts should provide the auto-discovered values. Accept defaults.
 
     Prompts should provide the auto-discovered values. Accept defaults.
  
4. On ipa1: Setup DNS forwarder for AD domain
+
5. On ipa1: Setup DNS forwarder for AD domain
 
     # ipa dnszone-add ad.lan --name-server=ad1.ad.lan --admin-email='hostmaster@ad.lan' \
 
     # ipa dnszone-add ad.lan --name-server=ad1.ad.lan --admin-email='hostmaster@ad.lan' \
 
     --force --forwarder=$AD1_IP --forward-policy=only
 
     --force --forwarder=$AD1_IP --forward-policy=only
  
5. On ad1: Setup DNS Forwarder for IPA domain
+
6. On ad1: Setup DNS Forwarder for IPA domain
 
     # dnscmd 127.0.0.1 /ZoneAdd ipa.lan /Forwarder $IPA1_IP
 
     # dnscmd 127.0.0.1 /ZoneAdd ipa.lan /Forwarder $IPA1_IP
 
     ? Do we need to run this for $IPA2_IP as well? or another command?
 
     ? Do we need to run this for $IPA2_IP as well? or another command?
 
6. On ipa1 and ipa2: verify IPA realm setup
 
    # wbinfo -online-status
 
  
 
7. On ipa1: Add cross-realm trust
 
7. On ipa1: Add cross-realm trust
Line 68: Line 68:
 
     }
 
     }
  
     # vi /etc/sssd/sssd.conf
+
     # systemctl restart krb5kdc.service
     [domain/ipa.lan]
+
     # systemctl restart sssd.service
    ...
 
    subdomains_provider = ipa
 
    ...
 
    [sssd]
 
    services = nss, pam, ssh, pac
 
    ? Is this one still necessary?  No right?
 
  
9. On  ipa1 and ipa2: enable make homedir function with authconfig
+
9. On  ipa1 and ipa2: enable make homedir function with authconfig if --mkhomedir wasn't used with ipa-*-install commands
     # authconfig --enablemkhomedir --updateall
+
     # authconfig --enablemkhomedir --update
    # systemctl restart sssd.service
+
 
    # systemctl restart sshd.service
+
10. On ipa1: Create external POSIX groups for trusted domain users
   
 
10. On ipa1 and ipa2: Restart FreeIPA KDC and SSSD services
 
    # systemctl restart krb5kdc.service
 
    # systemctl restart sssd.service</pre>
 
   
 
11. On ipa1: Create external POSIX groups for trusted domain users
 
 
     # ipa group-add --desc='ad.lan admins external map' ad_admins_external --external
 
     # ipa group-add --desc='ad.lan admins external map' ad_admins_external --external
  
 
     # ipa group-add --desc='ad.lan admins' ad_admins
 
     # ipa group-add --desc='ad.lan admins' ad_admins
 
    # wbinfo -n 'AD\Domain Admins'
 
    S-1-5-21-16904141-148189700-2149043814-512 SID_DOM_GROUP (2)
 
  
 
     # ipa group-add-member adadmins_external --external 'AD\Domain Admins'
 
     # ipa group-add-member adadmins_external --external 'AD\Domain Admins'
Line 104: Line 89:
 
     -------------------------
 
     -------------------------
  
12. On ipa1: Add external group to POSIX group
+
11. On ipa1: Add external group to POSIX group
 
     # ipa group-add-member ad_admins --groups ad_admins_external
 
     # ipa group-add-member ad_admins --groups ad_admins_external
  
13. On ipa1: SSH to ipa2 as external user
+
12. On ipa1: SSH to ipa2 as external user
 
     # kinit Administrator@AD.LAN
 
     # kinit Administrator@AD.LAN
 
     # ssh -k -l "Administrator@ad.lan" ipa2.ipa.lan
 
     # ssh -k -l "Administrator@ad.lan" ipa2.ipa.lan
  
14. On ipa2: SSH to ipa1 as external user
+
13. On ipa2: SSH to ipa1 as external user
 
     # kinit Administrator@AD.LAN
 
     # kinit Administrator@AD.LAN
 
     # ssh -l "Administrator@ad.lan" ipa1.ipa.lan
 
     # ssh -l "Administrator@ad.lan" ipa1.ipa.lan
  
15. On ad1:  SSH to ipa1 as AD user
+
14. On ad1:  SSH to ipa1 as AD user
 
     * Install standard putty from here:
 
     * Install standard putty from here:
 
       http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
 
       http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
Line 126: Line 111:
 
|optional=
 
|optional=
 
}}
 
}}
 +
 +
[[Category:Active_Directory_Test_Cases]] [[Category:FreeIPA_Test_Cases]]

Latest revision as of 19:06, 28 April 2014

Description

Configuring and testing cross-realm trust with Active Directory with multiple IPA servers

It should be noted that this is a simplified version of the following: QA:Testcase_freeipav3_ad_trust

For more information on FreeIPA Trust support, see the official guide here: IPAv3_AD_trust_setup

Setup

  1. Setup IPA Server per QA:Testcase_freeipav3_installation
  2. Setup IPA Replica per QA:Testcase_freeipav3_replication
  3. Setup AD Server per Setting_up_Active_Directory_domain_for_testing_purposes
  4. AD server: ad1.ad.lan
  5. AD Realm: AD.LAN
  6. IPA servers: ipa1.ipa.lan ipa2.ipa.lan
  7. IPA Realm: IPA.LAN

How to test

1. On ipa1 and ipa2: Install FreeIPA AD Trust related software

   # yum install freeipa-server-trust-ad

2. On ipa1: Setup IPA AD Trust with ipa-adtrust-install command

   # ipa-adtrust-install
   Prompts should provide the auto-discovered values.  Accept defaults.

3. Wait until replication happens... Should take not more than few minutes.

4. On ipa2: Setup IPA AD Trust with ipa-adtrust-install command

   # ipa-adtrust-install
   Prompts should provide the auto-discovered values. Accept defaults.

5. On ipa1: Setup DNS forwarder for AD domain

   # ipa dnszone-add ad.lan --name-server=ad1.ad.lan --admin-email='hostmaster@ad.lan' \
   --force --forwarder=$AD1_IP --forward-policy=only

6. On ad1: Setup DNS Forwarder for IPA domain

   # dnscmd 127.0.0.1 /ZoneAdd ipa.lan /Forwarder $IPA1_IP
   ? Do we need to run this for $IPA2_IP as well? or another command?

7. On ipa1: Add cross-realm trust

   # ipa trust-add --type=ad ad.lan --admin Administrator --password
   Active directory domain adminstrator's password:
   -------------------------------------------------
   Added Active Directory trust for realm "ad.lan"
   -------------------------------------------------
     Realm name: ad.lan
     Domain NetBIOS name: AD
     Domain Security Identifier: S-1-5-21-16904141-148189700-2149043814
     Trust direction: Two-way trust
     Trust type: Active Directory domain
     Trust status: Established and verified

8. On ipa1 and ipa2: Configure realm and domain mapping

   # vi /etc/krb5.conf
   [libdefaults]
   ....
    dns_lookup_kdc = true
   ....
   [realms]
   IPA.LAN = {
   ....
     auth_to_local = RULE:[1:$1@$0](^.*@AD.LAN$)s/@AD.LAN/@ad.lan/
     auth_to_local = DEFAULT
   }
   # systemctl restart krb5kdc.service
   # systemctl restart sssd.service

9. On ipa1 and ipa2: enable make homedir function with authconfig if --mkhomedir wasn't used with ipa-*-install commands

   # authconfig --enablemkhomedir --update

10. On ipa1: Create external POSIX groups for trusted domain users

   # ipa group-add --desc='ad.lan admins external map' ad_admins_external --external
   # ipa group-add --desc='ad.lan admins' ad_admins
   # ipa group-add-member adadmins_external --external 'AD\Domain Admins'
    [member user]: 
    [member group]: 
     Group name: ad_admins_external
     Description: AD.LAN admins external map
     External member: S-1-5-21-16904141-148189700-2149043814-512
   -------------------------
   Number of members added 1
   -------------------------

11. On ipa1: Add external group to POSIX group

   # ipa group-add-member ad_admins --groups ad_admins_external

12. On ipa1: SSH to ipa2 as external user

   # kinit Administrator@AD.LAN
   # ssh -k -l "Administrator@ad.lan" ipa2.ipa.lan

13. On ipa2: SSH to ipa1 as external user

   # kinit Administrator@AD.LAN
   # ssh -l "Administrator@ad.lan" ipa1.ipa.lan

14. On ad1: SSH to ipa1 as AD user

   * Install standard putty from here:
     http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
   * SSH with putty to ipa1 using GSSAPI
   * When prompted for user use "Administrator@ad.lan"

Expected Results

All the test steps should end with the above specified results.