On Пят, 29 ліс 2024, Aleksandr Sabirov via FreeIPA-users wrote:
Can you explain in more detail why? Thakns
What specifically? We do not support login to Windows machines as IPA users. This is not implemented. We have a work in progress to add that but it is incomplete yet. Windows machines always talk to their own Active Directory domain controllers. If AD DC issued a referral to other realm, they'll follow it up, but the referral will contain cross-realm TGS, so Windows client always starts from their DC and then follows up to a trusted domain's DC. In any case, Windows machines need more than just Kerberos to be able to login users and that part is not in FreeIPA releases yet. -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland -- _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
