< Features
FreeIPA v3 Trust Improvements
Summary
Multiple Domain Controllers and multiple additional DNS domains managed by FreeIPA can now be accessible via trusting relationship by Active Directory domain members.
Owner
- Name: Alexander Bokovoy
- Email: abokovoy@redhat.com
Current status
- Targeted release: Fedora 19
- Last updated: 2013-03-14
- Percentage of completion: 100%
Detailed Description
In Fedora 18 only a single designated Domain Controller in FreeIPA realm is supported for interoperability with Active Directory and only a primary DNS domain associated with the FreeIPA realm is advertised to the trusted party. FreeIPA v3.2 release adds support for multiple domain controllers per FreeIPA realm and multiple DNS domain suffixes associated with the realm, allowing for greater deployment flexibility.
Benefit to Fedora
System administrators, using FreeIPA in Fedora 19, will be able to designate FreeIPA domain controllers for interoperability with Active Directory and have greater flexibility in planning their domain topology.
Scope
The work is done in the scope of FreeIPA upstream development. List of development tasks is available here. Additional capabilities are provided as part of SSSD upstream development, designed and tracked here
How To Test
Test instructions for trust feature are available at http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup and extended to cover multi-DC configuration in https://fedoraproject.org/wiki/QA:Testcase_freeipav3_ad_realmdomains_windows and https://fedoraproject.org/wiki/QA:Testcase_freeipav3_ad_realmdomains
User Experience
FreeIPA-managed users will be able to log-in interactively to Windows machines in a trusted Active Directory domain. FreeIPA administrators will be able to configure multiple domain controllers and multiple DNS domain suffixes visible to a trusted Active Directory domain.
Dependencies
Depends on SSSD 1.10 and Kerberos 1.11, both in Fedora 19 already.
Contingency Plan
Feature implementation affects FreeIPA and SSSD. If SSSD part is not implemented in time, this feature is not delivered. There is no effects otherwise, previous behaviour is retained. Same goes for FreeIPA. Other parts of Fedora are not affected.
Documentation
- http://www.freeipa.org/page/V3/MultipleTrustServers
- https://fedorahosted.org/sssd/wiki/DesignDocs/GlobalCatalogLookups
Release Notes
- When using FreeIPA to trust Active Directory domain, it is now possible to designate multiple domain controllers in FreeIPA to serve Windows clients.
- FreeIPA adds management of additional domain suffixes visible to trusted Active Directory domain's clients.
- FreeIPA now implements Global Catalog service to allow Active Directory domain administrators grant access to their resources to FreeIPA users.