From Fedora Project Wiki
< Features
No edit summary |
No edit summary |
||
| (11 intermediate revisions by 2 users not shown) | |||
| Line 9: | Line 9: | ||
== Summary == | == Summary == | ||
<!-- A sentence or two summarizing what this feature is and what it will do. This information is used for the overall feature summary page for each release. --> | <!-- A sentence or two summarizing what this feature is and what it will do. This information is used for the overall feature summary page for each release. --> | ||
Multiple Domain Controllers and multiple additional DNS domains managed by FreeIPA can now be accessible via trusting relationship by Active Directory domain members. Additionally, Global Catalog service is provided for use by AD clients, allowing FreeIPA users to be included into access-control lists of AD resources. | Multiple Domain Controllers and multiple additional DNS domains managed by FreeIPA can now be accessible via trusting relationship by Active Directory domain members. | ||
<!-- De-scoped and targeted for F20: Additionally, Global Catalog service is provided for use by AD clients, allowing FreeIPA users to be included into access-control lists of AD resources. --> | |||
== Owner == | == Owner == | ||
| Line 20: | Line 22: | ||
== Current status == | == Current status == | ||
* Targeted release: [[Releases/19 | Fedora 19 ]] | * Targeted release: [[Releases/19 | Fedora 19 ]] | ||
* Last updated: 2013- | * Last updated: 2013-03-14 | ||
* Percentage of completion: | * Percentage of completion: 100% | ||
<!-- CHANGE THE "FedoraVersion" TEMPLATES ABOVE TO PLAIN NUMBERS WHEN YOU COMPLETE YOUR PAGE. --> | <!-- CHANGE THE "FedoraVersion" TEMPLATES ABOVE TO PLAIN NUMBERS WHEN YOU COMPLETE YOUR PAGE. --> | ||
== Detailed Description == | == Detailed Description == | ||
<!-- Expand on the summary, if appropriate. A couple sentences suffices to explain the goal, but the more details you can provide the better. --> | <!-- Expand on the summary, if appropriate. A couple sentences suffices to explain the goal, but the more details you can provide the better. --> | ||
In Fedora 18 only a single designated Domain Controller in FreeIPA realm is supported for interoperability with Active Directory and only a primary DNS domain associated with the FreeIPA realm is advertised to the trusted party. | In Fedora 18 only a single designated Domain Controller in FreeIPA realm is supported for interoperability with Active Directory and only a primary DNS domain associated with the FreeIPA realm is advertised to the trusted party. | ||
FreeIPA v3.2 release adds support for multiple domain controllers per FreeIPA realm and multiple DNS domain suffixes associated with the realm, allowing for greater deployment flexibility. | |||
<!-- De-scoped and targeted for F20: FreeIPA will also provide Global Catalog service implementation which is key feature to allow discretionary access to Active Directory resources for FreeIPA users --- making possible, for example, interactive logon to Windows machines under a FreeIPA identity. --> | |||
== Benefit to Fedora == | == Benefit to Fedora == | ||
<!-- What is the benefit to the platform? If this is a major capability update, what has changed? If this is a new feature, what capabilities does it bring? Why will Fedora become a better distribution or project because of this feature?--> | <!-- What is the benefit to the platform? If this is a major capability update, what has changed? If this is a new feature, what capabilities does it bring? Why will Fedora become a better distribution or project because of this feature?--> | ||
System administrators, using FreeIPA in Fedora 19, will get access to resources in trusted Active Directory domains. Active Directory domain administrators will be able to authorize access to their machines, services, and applications for FreeIPA-managed users and groups, giving practical bi-directional interoperability. | System administrators, using FreeIPA in Fedora 19, will be able to designate FreeIPA domain controllers for interoperability with Active Directory and have greater flexibility in planning their domain topology. | ||
<!-- De-scoped and targeted for F20: get access to resources in trusted Active Directory domains. Active Directory domain administrators will be able to authorize access to their machines, services, and applications for FreeIPA-managed users and groups, giving practical bi-directional interoperability. --> | |||
== Scope == | == Scope == | ||
<!-- What work do the developers have to accomplish to complete the feature in time for release? Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?--> | <!-- What work do the developers have to accomplish to complete the feature in time for release? Is it a large change affecting many parts of the distribution or is it a very isolated change? What are those changes?--> | ||
The work is done in the scope of FreeIPA | The work is done in the scope of FreeIPA upstream development. List of development tasks is available [https://fedorahosted.org/freeipa/report/39 here]. Additional capabilities are provided as part of SSSD upstream development, designed and tracked [https://fedorahosted.org/sssd/wiki/DesignDocs/GlobalCatalogLookups here] | ||
== How To Test == | == How To Test == | ||
| Line 52: | Line 56: | ||
3. What are the expected results of those actions? | 3. What are the expected results of those actions? | ||
--> | --> | ||
Test instructions for trust feature are available at http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup and extended to cover multi-DC configuration in https://fedoraproject.org/wiki/QA:Testcase_freeipav3_ad_realmdomains_windows and https://fedoraproject.org/wiki/QA:Testcase_freeipav3_ad_realmdomains | |||
== User Experience == | == User Experience == | ||
<!-- If this feature is noticeable by its target audience, how will their experiences change as a result? Describe what they will see or notice. --> | <!-- If this feature is noticeable by its target audience, how will their experiences change as a result? Describe what they will see or notice. --> | ||
FreeIPA-managed users will be able to log-in interactively to Windows machines in a trusted Active Directory domain. FreeIPA administrators will be able to configure multiple domain controllers and multiple DNS domain suffixes visible to a trusted Active Directory domain. | |||
== Dependencies == | == Dependencies == | ||
<!-- What other packages (RPMs) depend on this package? Are there changes outside the developers' control on which completion of this feature depends? In other words, completion of another feature owned by someone else and might cause you to not be able to finish on time or that you would need to coordinate? Other upstream projects like the kernel (if this is not a kernel feature)? --> | <!-- What other packages (RPMs) depend on this package? Are there changes outside the developers' control on which completion of this feature depends? In other words, completion of another feature owned by someone else and might cause you to not be able to finish on time or that you would need to coordinate? Other upstream projects like the kernel (if this is not a kernel feature)? --> | ||
Depends on SSSD 1.10 and Kerberos 1.11, both in Fedora 19 already. | |||
== Contingency Plan == | == Contingency Plan == | ||
<!-- If you cannot complete your feature by the final development freeze, what is the backup plan? This might be as simple as "None necessary, revert to previous release behaviour." Or it might not. If you feature is not completed in time we want to assure others that other parts of Fedora will not be in jeopardy. --> | <!-- If you cannot complete your feature by the final development freeze, what is the backup plan? This might be as simple as "None necessary, revert to previous release behaviour." Or it might not. If you feature is not completed in time we want to assure others that other parts of Fedora will not be in jeopardy. --> | ||
Feature implementation affects FreeIPA and SSSD. If SSSD part is not implemented in time, this feature is not delivered. There is no effects otherwise, previous behaviour is retained. Same goes for FreeIPA. Other parts of Fedora are not affected. | |||
== Documentation == | == Documentation == | ||
<!-- Is there upstream documentation on this feature, or notes you have written yourself? Link to that material here so other interested developers can get involved. --> | <!-- Is there upstream documentation on this feature, or notes you have written yourself? Link to that material here so other interested developers can get involved. --> | ||
* | * http://www.freeipa.org/page/V3/MultipleTrustServers | ||
* https://fedorahosted.org/sssd/wiki/DesignDocs/GlobalCatalogLookups | |||
== Release Notes == | == Release Notes == | ||
<!-- The Fedora Release Notes inform end-users about what is new in the release. Examples of past release notes are here: http://docs.fedoraproject.org/release-notes/ --> | <!-- The Fedora Release Notes inform end-users about what is new in the release. Examples of past release notes are here: http://docs.fedoraproject.org/release-notes/ --> | ||
<!-- The release notes also help users know how to deal with platform changes such as ABIs/APIs, configuration or data file formats, or upgrade concerns. If there are any such changes involved in this feature, indicate them here. You can also link to upstream documentation if it satisfies this need. This information forms the basis of the release notes edited by the documentation team and shipped with the release. --> | <!-- The release notes also help users know how to deal with platform changes such as ABIs/APIs, configuration or data file formats, or upgrade concerns. If there are any such changes involved in this feature, indicate them here. You can also link to upstream documentation if it satisfies this need. This information forms the basis of the release notes edited by the documentation team and shipped with the release. --> | ||
* | * When using FreeIPA to trust Active Directory domain, it is now possible to designate multiple domain controllers in FreeIPA to serve Windows clients. | ||
* FreeIPA adds management of additional domain suffixes visible to trusted Active Directory domain's clients. | |||
* FreeIPA now implements Global Catalog service to allow Active Directory domain administrators grant access to their resources to FreeIPA users. | |||
== Comments and Discussion == | == Comments and Discussion == | ||
* See [[Talk:Features/ | * See [[Talk:Features/IPAv3TrustImprovements]] <!-- This adds a link to the "discussion" tab associated with your page. This provides the ability to have ongoing comments or conversation without bogging down the main feature page --> | ||
[[Category: | [[Category:FeatureAcceptedF19]] | ||
<!-- When your feature page is completed and ready for review --> | <!-- When your feature page is completed and ready for review --> | ||
<!-- remove Category:FeaturePageIncomplete and change it to Category:FeatureReadyForWrangler --> | <!-- remove Category:FeaturePageIncomplete and change it to Category:FeatureReadyForWrangler --> | ||
<!-- After review, the feature wrangler will move your page to Category:FeatureReadyForFesco... if it still needs more work it will move back to Category:FeaturePageIncomplete--> | <!-- After review, the feature wrangler will move your page to Category:FeatureReadyForFesco... if it still needs more work it will move back to Category:FeaturePageIncomplete--> | ||
<!-- A pretty picture of the page category usage is at: https://fedoraproject.org/wiki/Features/Policy/Process --> | <!-- A pretty picture of the page category usage is at: https://fedoraproject.org/wiki/Features/Policy/Process --> | ||
Latest revision as of 10:47, 10 May 2013
FreeIPA v3 Trust Improvements
Summary
Multiple Domain Controllers and multiple additional DNS domains managed by FreeIPA can now be accessible via trusting relationship by Active Directory domain members.
Owner
- Name: Alexander Bokovoy
- Email: abokovoy@redhat.com
Current status
- Targeted release: Fedora 19
- Last updated: 2013-03-14
- Percentage of completion: 100%
Detailed Description
In Fedora 18 only a single designated Domain Controller in FreeIPA realm is supported for interoperability with Active Directory and only a primary DNS domain associated with the FreeIPA realm is advertised to the trusted party. FreeIPA v3.2 release adds support for multiple domain controllers per FreeIPA realm and multiple DNS domain suffixes associated with the realm, allowing for greater deployment flexibility.
Benefit to Fedora
System administrators, using FreeIPA in Fedora 19, will be able to designate FreeIPA domain controllers for interoperability with Active Directory and have greater flexibility in planning their domain topology.
Scope
The work is done in the scope of FreeIPA upstream development. List of development tasks is available here. Additional capabilities are provided as part of SSSD upstream development, designed and tracked here
How To Test
Test instructions for trust feature are available at http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup and extended to cover multi-DC configuration in https://fedoraproject.org/wiki/QA:Testcase_freeipav3_ad_realmdomains_windows and https://fedoraproject.org/wiki/QA:Testcase_freeipav3_ad_realmdomains
User Experience
FreeIPA-managed users will be able to log-in interactively to Windows machines in a trusted Active Directory domain. FreeIPA administrators will be able to configure multiple domain controllers and multiple DNS domain suffixes visible to a trusted Active Directory domain.
Dependencies
Depends on SSSD 1.10 and Kerberos 1.11, both in Fedora 19 already.
Contingency Plan
Feature implementation affects FreeIPA and SSSD. If SSSD part is not implemented in time, this feature is not delivered. There is no effects otherwise, previous behaviour is retained. Same goes for FreeIPA. Other parts of Fedora are not affected.
Documentation
- http://www.freeipa.org/page/V3/MultipleTrustServers
- https://fedorahosted.org/sssd/wiki/DesignDocs/GlobalCatalogLookups
Release Notes
- When using FreeIPA to trust Active Directory domain, it is now possible to designate multiple domain controllers in FreeIPA to serve Windows clients.
- FreeIPA adds management of additional domain suffixes visible to trusted Active Directory domain's clients.
- FreeIPA now implements Global Catalog service to allow Active Directory domain administrators grant access to their resources to FreeIPA users.