[Freeipa-users] Re: AD trust and ACL on OUs

Hi list, I have an issue with an AD one-way trust to IPA, where the AD is configured with a very specific set of ACL's on the various OUs where the user accounts live. Authenticated Users cannot search for all users in the AD LDAP directory. This is done as the AD is hosting a multi-tenant environment, and there exists a requirement for different customers accounts not to be visible by everyone. The issue for IPA is when SSSD is attempting to look up the users details in AD via LDAP, using it's trust account (cn=IPADOM$,cn=Users,dc=ad,dc=local). This trust account does not have the required permissions to search for all the users in the AD LDAP tree, the AD user is not found by SSSD, and is denied logon access. As the IPADOM$ account is a special trust account, it is not possible to add this account to the AD group which is normally used to grant access to service accounts to read the entire AD LDAP directory.