ipa-adtrust-install(1) IPA Manual Pages ipa-adtrust-install(1)
ipa-adtrust-install - Prepare an IPA server to be able to establish trust relationships
with AD domains
Adds all necessary objects and configuration to allow an IPA server to create a trust to
an Active Directory domain. This requires that the IPA server is already installed and
Please note you will not be able to estabilish an trust to an Active Directory domain
unless the realm name of the IPA server matches its domain name.
ipa-adtrust-install can be run multiple times to reinstall deleted objects or broken con-
figuration files. E.g. a fresh samba configuration (smb.conf file and registry based con-
figuration can be created. Other items like e.g. the configuration of the local range can-
not be changed by running ipa-adtrust-install a second time because with changes here
other objects might be affected as well.
Enable debug logging when more verbose output is needed
The IP address of the IPA server. If not provided then this is determined based on
the hostname of the server.
The NetBIOS name for the IPA domain. If not provided then this is determined based
on the leading component of the DNS domain name. Running ipa-adtrust-install for a
second time with a different NetBIOS name will change the name. Please note that
changing the NetBIOS name might break existing trust relationships to other
Do not create DNS service records for Windows in managed DNS server. Since those
DNS service records are the only way to discover domain controllers of other
domains they must be added manually to a different DNS server to allow trust reala-
tionships work properly. All needed service records are listed when
ipa-adtrust-install finishes and either --no-msdcs was given or no IPA DNS service
is configured. Typically service records for the following service names are needed
for the IPA domain which should point to all IPA servers:
Add SIDs to existing users and groups as a final step of the ipa-adtrust-install
run. If there a many existing users and groups and a couple of replicas in the
environment this operation might lead to a high replication traffic and a perfor-
mance degradation of all IPA servers in the environment. To avoid this the SID gen-
eration can be run after ipa-adtrust-install is run and scheduled independently. To
start this task you have to load an edited version of ipa-sidgen-task-run.ldif with
the ldapmodify command info the directory server.
An unattended installation that will never prompt for user input
First RID value of the local domain. The first Posix ID of the local domain will be
assigned to this RID, the second to RID+1 etc. See the online help of the idrange
CLI for details.
Start value of the secondary RID range, which is only used in the case a user and a
group share numerically the same Posix ID. See the online help of the idrange CLI
The name of the user with administrative privileges for this IPA server. Defaults
The password of the user with administrative privileges for this IPA server. Will
be asked interactively if -U is not specified.
The credentials of the admin user will be used to obtain Kerberos ticket before configur-
ing cross-realm trusts support and afterwards, to ensure that the ticket contains MS-PAC
information required to actually add a trust with Active Directory domain via 'ipa trust-
add --type=ad' command.
Enables support for trusted domains users for old clients through Schema Compati-
bility plugin. SSSD supports trusted domains natively starting with version 1.9.
For platforms that lack SSSD or run older SSSD version one needs to use this
option. When enabled, slapi-nis package needs to be installed and schema-com-
pat-plugin will be configured to provide lookup of users and groups from trusted
domains via SSSD on IPA server. These users and groups will be available under
cn=users,cn=compat,$SUFFIX and cn=groups,cn=compat,$SUFFIX trees. SSSD will nor-
malize names of users and groups to lower case.
In addition to providing these users and groups through the compat tree, this
option enables authentication over LDAP for trusted domain users with DN under com-
pat tree, i.e. using bind DN email@example.com,cn=users,cn=compat,$SUF-
LDAP authentication performed by the compat tree is done via PAM 'system-auth' ser-
vice. This service exists by default on Linux systems and is provided by pam pack-
age as /etc/pam.d/system-auth. If your IPA install does not have default HBAC rule
'allow_all' enabled, then make sure to define in IPA special service called 'sys-
tem-auth' and create an HBAC rule to allow access to anyone to this rule on IPA
As 'system-auth' PAM service is not used directly by any other application, it is
safe to use it for trusted domain users via compatibility path.
0 if the installation was successful
1 if an error occurred
IPA Aug 23 2011 ipa-adtrust-install(1)