[Freeipa-users] Cross Forest Transitive AD Trust

[PARTH MONGA]

Hi List Members,

I have a situation I am having a hard time getting a clean answer on.

I have a IDM/IPA domain setup and I have a trust setup with my Windows
domain. That part is working perfectly.

I have a one way forest transitive trust (outgoing) with a second windows
domain. I want users in this second domain to be able to authenticate to my
IDM/IPA domain. I was hoping that this would be possible through my
transitive trust with my primary windows domain.

When I issue the command ipa trust-fetch-domains for my primary domain I
get the response no new domains found. The second domain is never found.

Here is my question. Is this even possible without creating a trust with
the second domain directly? The documentation states that IPA will traverse
all trusts and add them. However I am starting to believe that reference is
for domains in only one forest. Can anyone clear up that point for me?

Regards,

Parth

[Alexander Bokovoy]

Post by PARTH MONGA
Hi List Members,
I have a situation I am having a hard time getting a clean answer on.
I have a IDM/IPA domain setup and I have a trust setup with my Windows
domain. That part is working perfectly.
I have a one way forest transitive trust (outgoing) with a second windows
domain. I want users in this second domain to be able to authenticate to my
IDM/IPA domain. I was hoping that this would be possible through my
transitive trust with my primary windows domain.

No, that's not possible by AD architecture.

Post by PARTH MONGA
When I issue the command ipa trust-fetch-domains for my primary domain I
get the response no new domains found. The second domain is never found.

That's correct.

Post by PARTH MONGA
Here is my question. Is this even possible without creating a trust with
the second domain directly? The documentation states that IPA will traverse
all trusts and add them. However I am starting to believe that reference is
for domains in only one forest. Can anyone clear up that point for me?

The documentation is correct, you can have multiple trusts to separate
forests and domains from all of them will be usable via trust to IPA.
However, we cannot access any domains from forests that AD forest trusts
itself because while forest trust is transitive, the transition is only
extends to domains within the forests that trust each other, there is no
transitivity across forest trusts.

If forest A's root domain A trusts forest B's root domain B, and forest
B's root domain B trusts forest C's root domain C, then A only can
transit to domains in forest B, not forest C.

See https://msdn.microsoft.com/en-us/library/cc773178%28v=ws.10%29.aspx,
search for the section named "Forest trusts":
---------
Forest trusts can be created between two forests only and cannot be
implicitly extended to a third forest.
---------

[PARTH MONGA]

Thanks Alexander for the prompt reply.
Appreciated.

Now i am wondering how likewise is able to do this stuff under the hood for
me.

I have similar setup with likewise and same one way incoming trust
relationships towards my primary domain (dom1) from another external domain
(dom2).

And i am able to login to my client machines using user accounts created in
dom1 and dom2.
Magic
Any thoughts >

Post by Alexander Bokovoy

Post by PARTH MONGA
Hi List Members,
I have a situation I am having a hard time getting a clean answer on.
I have a IDM/IPA domain setup and I have a trust setup with my Windows
domain. That part is working perfectly.
I have a one way forest transitive trust (outgoing) with a second windows
domain. I want users in this second domain to be able to authenticate to my
IDM/IPA domain. I was hoping that this would be possible through my
transitive trust with my primary windows domain.

No, that's not possible by AD architecture.

Post by PARTH MONGA
When I issue the command ipa trust-fetch-domains for my primary domain I
get the response no new domains found. The second domain is never found.

That's correct.
Here is my question. Is this even possible without creating a trust with

Post by PARTH MONGA
the second domain directly? The documentation states that IPA will traverse
all trusts and add them. However I am starting to believe that reference is
for domains in only one forest. Can anyone clear up that point for me?

The documentation is correct, you can have multiple trusts to separate
forests and domains from all of them will be usable via trust to IPA.
However, we cannot access any domains from forests that AD forest trusts
itself because while forest trust is transitive, the transition is only
extends to domains within the forests that trust each other, there is no
transitivity across forest trusts.
If forest A's root domain A trusts forest B's root domain B, and forest
B's root domain B trusts forest C's root domain C, then A only can
transit to domains in forest B, not forest C.
See https://msdn.microsoft.com/en-us/library/cc773178%28v=ws.10%29.aspx,
---------
Forest trusts can be created between two forests only and cannot be
implicitly extended to a third forest. ---------
--
/ Alexander Bokovoy

[Alexander Bokovoy]

Post by PARTH MONGA
Thanks Alexander for the prompt reply.
Appreciated.
Now i am wondering how likewise is able to do this stuff under the hood for
me.
I have similar setup with likewise and same one way incoming trust
relationships towards my primary domain (dom1) from another external domain
(dom2).

You need to get your terminology right. Can you explain which of the
cases from https://kb.vmware.com/kb/2064250 would apply to your
situation?

There are quite a number of differences between different types of
trust.

Post by PARTH MONGA
And i am able to login to my client machines using user accounts created in
dom1 and dom2.
Magic
Any thoughts >

There is no magic here, your likewise setup is using different trust
mode than what IPA does. Most likely your likewise setup is a domain in
dom1 forest already.