You could probably establish two-way trust between AD and IPA domains. Is seems such configuration is supported: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/... - Boris Sukhinin

I have an open RFE for global catalogs for a while now. Last update for target release is 7.5/7.6 timeframe :( -- gracie mobile > On Feb 6, 2018, at 7:25 AM, Alexander Bokovoy via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org&gt; wrote: > > > > ----- Original Message ----- >> Hi, >> >> Clearly my Google skills are lacking, as I've not been able to find anything >> definitive (mainly just old versions of IPA) >> >> We have a well used FreeIPA domain, but I have a few appliances and >> applications that require Active Directory. I can find information about >> configuring AD to trust freeIPA, but not the other way around. Can we >> configure our IPA at example.com to be trusted by an AD subdomain at >> ad.example.com ? And if so, can anyone point me in the right direction? > Two-way trust can be configured but it will not help you. Windows Clients require Global Catalog service from a trust Active Directory forest to perform user/group lookups which IPA does not provide. > > -- > / Alexander Bokovoy > _______________________________________________ > FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org > To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org