Re: [Freeipa-devel] One-way trust design

2015-04-01 Thread Jakub Hrozek
Thank you, the design page reads well to me. I had a short chat with Alexander where we cleared up some confusion. On Mon, Feb 23, 2015 at 06:02:53PM +0200, Alexander Bokovoy wrote: == New design == In order to support one-way trust to Active Directory, we need to switch SSSD in IPA master

Re: [Freeipa-devel] One-way trust design

2015-03-03 Thread Alexander Bokovoy
On Tue, 03 Mar 2015, Jan Pazdziora wrote: On Mon, Feb 23, 2015 at 06:02:53PM +0200, Alexander Bokovoy wrote: trust-related functionality would be limited to IPA admins or TDO object in LDAP would have to be more accessible. Given that TDO credentials can be used to compromise access to our

Re: [Freeipa-devel] One-way trust design

2015-03-03 Thread Jan Pazdziora
On Mon, Feb 23, 2015 at 06:02:53PM +0200, Alexander Bokovoy wrote: trust-related functionality would be limited to IPA admins or TDO object in LDAP would have to be more accessible. Given that TDO credentials can be used to compromise access to our domain, it is not Could you clarify which

[Freeipa-devel] One-way trust design

2015-02-23 Thread Alexander Bokovoy
Hi! I've added a design page for one-way trust to www.freeipa.org/page/V4/One-way_trust Below is the page content for easy discussion: {{Feature|version=4.2.0|ticket=4546|author=Ab}} = Overview = Active Directory