Samba4/Proposal for IPA to AD trust

Purpose

To link FreeIPA to AD in a way that minimises replication of data.

Key assumptions

IPA and AD are both seperate DNS domains, seen by each other in the same company, that administrators which to join in such a way that users and services are easily accessed on both sides of the trust, using Kerberos.

That Kerberos is the only authentication protocol in use (that fallback to NTLM has been disabled or is unwanted)

Basic Design

The only sensible trust mechanism for this task is a 'Forest Trust'. This modal provides for mismatching schema, and mismatching functional levels, both of which are highly desirable (to avoid forced upgrades with the AD infrastructure).

The design consists of these parts:

KDC

A single KDC