ipa-adtrust-install(1)						 IPA Manual Pages					    ipa-adtrust-install(1)

NAME

       ipa-adtrust-install - Prepare an IPA server to be able to establish trust relationships with AD domains

SYNOPSIS

       ipa-adtrust-install [OPTION]...

DESCRIPTION

       Adds all necessary objects and configuration to allow an IPA server to create a trust to an Active Directory domain. This requires that the
       IPA server is already installed and configured.

       Please note you will not be able to estabilish an trust to an Active Directory domain unless the realm name of the IPA server  matches  its
       domain name.

       ipa-adtrust-install  can be run multiple times to reinstall deleted objects or broken configuration files. E.g. a fresh samba configuration
       (smb.conf file and registry based configuration can be created. Other items like e.g. the  configuration  of  the  local  range	cannot	be
       changed by running ipa-adtrust-install a second time because with changes here other objects might be affected as well.

OPTIONS

       -d, --debug
	      Enable debug logging when more verbose output is needed

       --ip-address=IP_ADDRESS
	      The IP address of the IPA server. If not provided then this is determined based on the hostname of the server.

       --netbios-name=NETBIOS_NAME
	      The  NetBIOS name for the IPA domain. If not provided then this is determined based on the leading component of the DNS domain name.
	      Running ipa-adtrust-install for a second time with a different NetBIOS name will change the name. Please note that changing the Net-
	      BIOS name might break existing trust relationships to other domains.

       --no-msdcs
	      Do  not  create  DNS service records for Windows in managed DNS server. Since those DNS service records are the only way to discover
	      domain controllers of other domains they must be added manually to a different DNS server to allow trust realationships  work  prop-
	      erly.  All needed service records are listed when ipa-adtrust-install finishes and either --no-msdcs was given or no IPA DNS service
	      is configured. Typically service records for the following service names are needed for the IPA domain which should point to all IPA
	      servers:

	      o _ldap._tcp

	      o _kerberos._tcp

	      o _kerberos._udp

	      o _ldap._tcp.dc._msdcs

	      o _kerberos._tcp.dc._msdcs

	      o _kerberos._udp.dc._msdcs

	      o _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs

	      o _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs

	      o _kerberos._udp.Default-First-Site-Name._sites.dc._msdcs

       --add-sids
	      Add  SIDs to existing users and groups as a final step of the ipa-adtrust-install run. If there a many existing users and groups and
	      a couple of replicas in the environment this operation might lead to a high replication traffic and a performance degradation of all
	      IPA  servers in the environment. To avoid this the SID generation can be run after ipa-adtrust-install is run and scheduled indepen-
	      dently. To start this task you have to load an edited version of ipa-sidgen-task-run.ldif  with  the  ldapmodify	command  info  the
	      directory server.

       -U, --unattended
	      An unattended installation that will never prompt for user input

       -U, --rid-base=RID_BASE
	      First  RID  value of the local domain. The first Posix ID of the local domain will be assigned to this RID, the second to RID+1 etc.
	      See the online help of the idrange CLI for details.

       -U, --secondary-rid-base=SECONDARY_RID_BASE
	      Start value of the secondary RID range, which is only used in the case a user and a group share numerically the same Posix  ID.  See
	      the online help of the idrange CLI for details.

       -A, --admin-name=ADMIN_NAME
	      The name of the user with administrative privileges for this IPA server. Defaults to 'admin'.

       -a, --admin-password=password
	      The password of the user with administrative privileges for this IPA server. Will be asked interactively if -U is not specified.

       The  credentials  of the admin user will be used to obtain Kerberos ticket before configuring cross-realm trusts support and afterwards, to
       ensure that the ticket contains MS-PAC information required to actually add a  trust  with  Active  Directory  domain  via  'ipa  trust-add
       --type=ad' command.

       --enable-compat
	      Enables  support	for  trusted  domains  users  for  old clients through Schema Compatibility plugin.  SSSD supports trusted domains
	      natively starting with version 1.9. For platforms that lack SSSD or run older SSSD version  one  needs  to  use  this  option.  When
	      enabled,	slapi-nis  package needs to be installed and schema-compat-plugin will be configured to provide lookup of users and groups
	      from trusted domains via SSSD on IPA server.  These  users  and  groups  will  be  available  under  cn=users,cn=compat,$SUFFIX  and
	      cn=groups,cn=compat,$SUFFIX trees.  SSSD will normalize names of users and groups to lower case.

	      In  addition  to	providing these users and groups through the compat tree, this option enables authentication over LDAP for trusted
	      domain users with DN under compat tree, i.e. using bind DN uid=administrator@ad.domain,cn=users,cn=compat,$SUFFIX.

	      LDAP authentication performed by the compat tree is done via PAM 'system-auth' service.  This service exists  by	default  on  Linux
	      systems  and  is provided by pam package as /etc/pam.d/system-auth.  If your IPA install does not have default HBAC rule 'allow_all'
	      enabled, then make sure to define in IPA special service called 'system-auth' and create an HBAC rule to allow access to	anyone	to
	      this rule on IPA masters.

	      As  'system-auth'  PAM service is not used directly by any other application, it is safe to use it for trusted domain users via com-
	      patibility path.

       EXIT STATUS
	      0 if the installation was successful

	      1 if an error occurred

IPA
								    Aug 23 2011 					    ipa-adtrust-install(1)