Hi,

We use an IPA domain for a large part of our internal servers.

Our first one-way trust implementation was not properly working because of routing issues. Two-way trust in our environment is not possible, because normal users are limited. (we can resolve 'system/service' accounts without those limitations)

After finding out about this limitation, we did again configure one-way trust. This time, we found about the registry / GPO solution to direct windows clients to the IPA KDC's. ( https://gpo.wiki/wiki/Kerberos.admx:Computer_Configuration#Define_host_name-... ) And all is working properly...

Last week we received a request from an external company that wants AD integration. They will manage their own set of RHEL servers for a specific project. I proposed they can use the IDM domain for feature-full integration with the AD domain.

But.... there is some discussion going on.... our AD architect(s) calls the IPA integration with AD lacking. Their opinion is that windows clients should discover automatically when they need a IPA KDC Also, they find it a severe issue that everything is hidden after one SID (which is given permissions with the correct search scope) As such they can' t see/discover anything in the IPA domain (logically...)

So the Windows / AD guys propose a direct integration using a keytab - without thinking about the requirements, and comparing with network devices or appliances I am not talking about realmd.

What is the up-to-date opinion on SSSD realmd integration versus IDM integration? Or other options? What will the external company be losing in features? And which has most risks?

But most of all: what can we do to make IPA domain<-> AD domain integration better?

Sincerely, Pieter