ipa-adtrust-install(1)

💖 ipa-adtrust-install(1) 💖

okay bestie, welcome to the IPA Manual Pages glow-up 💅 today we're talking about ipa-adtrust-install, the little command that gets your IPA server ready to make friends with Active Directory. grab a strawberry 🍓 and let's go.

---

✨ NAME ✨

ipa-adtrust-install — get an IPA server set up so it can establish trust relationships with AD domains 🫶

---

✨ SYNOPSIS ✨

ipa-adtrust-install [OPTION]...

---

✨ DESCRIPTION ✨

So what does it do? It adds all the necessary objects and configuration so that an IPA server can create a trust to an Active Directory domain. Iconic. But heads up — this requires that the IPA server is already installed and configured. It's a glow-up, not a from-scratch build. 💅

Also, real talk: you will not be able to establish a trust to an Active Directory domain unless the realm name of the IPA server matches its domain name. that's the vibe check, and it is non-negotiable. 🙈

Good news though: ipa-adtrust-install can be run multiple times to reinstall deleted objects or broken configuration files. Like, say, a fresh samba configuration (smb.conf) file and registry based configuration can be created. ✨ But some other items — like the configuration of the local range — cannot be changed by running ipa-adtrust-install a second time, because changing stuff there might affect other objects too. so basically: reruns are for repairs, not for remixes. 😭

🔥 Firewall Requirements 🔥

On top of the normal IPA server firewall requirements, ipa-adtrust-install needs these ports open so IPA and Active Directory can actually talk to each other:

TCP Ports

• 135/tcp EPMAP
• 445/tcp Microsoft-DS
• 1024/tcp through 1300/tcp — this range lets EPMAP on port 135/tcp create a TCP listener based on an incoming request.
• 3268/tcp Microsoft-GC

UDP Ports

• 389/udp LDAP

---

✨ OPTIONS ✨

• -d, --debug — turns on debug logging when you need that extra verbose output, iykyk 🐛
• --netbios-name=NETBIOS_NAME — the NetBIOS name for the IPA domain. If you don't hand one over, it gets determined based on the leading component of the DNS domain name. Running ipa-adtrust-install a second time with a different NetBIOS name will change the name — and psst, changing the NetBIOS name might break existing trust relationships to other domains. ⚠️ careful queen.
• --add-sids — adds SIDs to existing users and groups as one of the final steps of the ipa-adtrust-install run. Now listen: if there are a many existing users and groups and a couple of replicas in the environment, this operation might lead to a high replication traffic and a performance degradation of all IPA servers in the environment. 💀 To avoid this, the SID generation can be run after ipa-adtrust-install is run and scheduled independently. To start this task you have to load an edited version of ipa-sidgen-task-run.ldif with the ldapmodify command info the directory server.
• --add-agents — adds IPA masters to the list that allows them to serve information about users from trusted forests. Starting with IPA 4.2, a regular IPA master can provide this information to SSSD clients. IPA masters aren't added to the list automatically though, because a restart of the LDAP service on each of them is required. The host where ipa-adtrust-install is being run gets added automatically. 🫶

Note that IPA masters where ipa-adtrust-install wasn't run can serve information about users from trusted forests only if they are enabled via ipa-adtrust-install run on any other IPA master. And at least SSSD version 1.13 on the IPA master is required to be able to perform as a trust agent. no shortcuts bestie ✨

• -U, --unattended — an unattended installation that will never prompt for user input. set it and forget it, main character energy 👑
• --rid-base=RID_BASE — first RID value of the local domain. The first POSIX ID of the local domain will be assigned to this RID, the second to RID+1, etc. See the online help of the idrange CLI for details. 🔢
• --secondary-rid-base=SECONDARY_RID_BASE — start value of the secondary RID range, which is only used in the case a user and a group share numerically the same POSIX ID. See the online help of the idrange CLI for details. 🎀
• -A, --admin-name=ADMIN_NAME — the name of the user with administrative privileges for this IPA server. Defaults to 'admin'. 💖
• -a, --admin-password=password — the password of the user with administrative privileges for this IPA server. Will be asked interactively if -U is not specified. 🔐

The credentials of the admin user will be used to obtain a Kerberos ticket before configuring cross-realm trusts support, and afterwards, to ensure that the ticket contains MS-PAC information required to actually add a trust with an Active Directory domain via the ipa trust-add --type=ad command. 🎟️

• --enable-compat — enables support for trusted domains users for old clients through the Schema Compatibility plugin. SSSD supports trusted domains natively starting with version 1.9, so for platforms that lack SSSD or run an older SSSD version, one needs to use this option. When enabled, the slapi-nis package needs to be installed and schema-compat-plugin will be configured to provide lookup of users and groups from trusted domains via SSSD on the IPA server. These users and groups will be available under cn=users,cn=compat,$SUFFIX and cn=groups,cn=compat,$SUFFIX trees. SSSD will normalize names of users and groups to lower case. 🌸

In addition to providing these users and groups through the compat tree, this option enables authentication over LDAP for trusted domain users with DN under the compat tree, i.e. using bind DN uid=administrator@ad.domain,cn=users,cn=compat,$SUFFIX. 💅

LDAP authentication performed by the compat tree is done via PAM 'system-auth' service. This service exists by default on Linux systems and is provided by the pam package as /etc/pam.d/system-auth. If your IPA install does not have the default HBAC rule 'allow_all' enabled, then make sure to define in IPA a special service called 'system-auth' and create an HBAC rule to allow access to anyone to this rule on IPA masters. ⚠️

As the 'system-auth' PAM service is not used directly by any other application, it is safe to use it for trusted domain users via the compatibility path. ✅

---

✨ EXIT STATUS ✨

• 0 if the installation was successful 🎉 slay!
• 1 if an error occurred 😭 we've all been there

---

and that's the whole page, bestie — no notes, you ate. 🦋

this was brought to you by the IPA manual, dated April 11 2017, from ipa-adtrust-install(1) in the IPA Manual Pages set. go forth and trust some forests responsibly. 💜🌸🎀