[root@ipaserver ~]# ipa trust-add --type=ad ad.example.com --trust-secret --two-way=True
Shared secret for the trust:
-------------------------------------------------------
Added Active Directory trust for realm "ad.example.com"
-------------------------------------------------------
  Realm-Name: ad.example.com
  Domain NetBIOS name: AD
  Domain Security Identifier: S-1-5-21-796215754-1239681026-23416912
  SID blacklist incoming: S-1-5-20, S-1-5-3, S-1-5-2, S-1-5-1, S-1-5-7, S-1-5-6,
                          S-1-5-5, S-1-5-4, S-1-5-9, S-1-5-8, S-1-5-17, S-1-5-16,
                          S-1-5-15, S-1-5-14, S-1-5-13, S-1-5-12, S-1-5-11,
                          S-1-5-10, S-1-3, S-1-2, S-1-1, S-1-0, S-1-5-19, S-1-5-18
  SID blacklist outgoing: S-1-5-20, S-1-5-3, S-1-5-2, S-1-5-1, S-1-5-7, S-1-5-6,
                          S-1-5-5, S-1-5-4, S-1-5-9, S-1-5-8, S-1-5-17, S-1-5-16,
                          S-1-5-15, S-1-5-14, S-1-5-13, S-1-5-12, S-1-5-11,
                          S-1-5-10, S-1-3, S-1-2, S-1-1, S-1-0, S-1-5-19, S-1-5-18
  Trust direction: Trusting forest
  Trust type: Active Directory domain
  Trust status: Waiting for confirmation by remote side

[root@ipaserver ~]# ipa trust-show ad.example.com

  Domain NetBIOS name: AD
  Domain Security Identifier: S-1-5-21-796215754-1239681026-23416912
  Trust direction: Trusting forest
  Trust type: Active Directory domain

1. Add a new ipaNTSecurityIdentifier attribute, containing a SID, automatically for each entry by running the ipa-sidgen-task operation on the back-end LDAP directory.

   [root@ipaserver ]# ldapmodify -x -H ldap://ipaserver.ipa.example.com:389 -D "cn=directory manager" -w password
   
   dn: cn=sidgen,cn=ipa-sidgen-task,cn=tasks,cn=config
   changetype: add
   objectClass: top
   objectClass: extensibleObject
   cn: sidgen
   nsslapd-basedn: dc=ipadomain,dc=com
   delay: 0
   
   adding new entry "cn=sidgen,cn=ipa-sidgen-task,cn=tasks,cn=config"

2. After the task completes successfully, a message is recorded in the error logs that the SID generation task (Sidgen task) finished with a status of zero (0).

   [root@ipaserver ]# grep "sidgen_task_thread" /var/log/dirsrv/slapd-IDM-EXAMPLE-COM/errors
   [20/Jul/2012:18:17:16 +051800] sidgen_task_thread - [file ipa_sidgen_task.c, line 191]: Sidgen task starts ...
   [20/Jul/2012:18:17:16 +051800] sidgen_task_thread - [file ipa_sidgen_task.c, line 196]: Sidgen task finished [0].

https://ipaserver.example.com

1. Provide the AD domain name in the Domain field.
2. To set up the trust as two-way, select the Two-way trust check box. To set up the trust as one-way, leave Two-way trust unselected.
   For more information about one-way and two-way trusts, see Section 5.1.4, “One-Way and Two-Way Trusts”.
3. To establish an external trust to a domain in another forest, select the External Trust check box.
   For more information, see Section 5.1.5, “External Trusts to Active Directory”.
4. The Establish using section defines how the trust is to be established:
   • To establish the trust using the AD administrator's user name and password, select Administrative account and provide the required credentials.
   • Alternatively, to establish the trust with a shared password, select Pre-shared password and provide the trust password.
5. Define the ID configuration for the trust:
   • The Range type option allows you to choose the ID range type. If you want IdM to automatically detect what kind of ID range to use, select Detect.
   • To define the starting ID of the ID range, use the Base ID field. To define the size of the ID range, use the Range size field. If you want IdM to use default values for the ID range, do not specify these options.
   For more information about ID ranges, see the section called “ID Ranges”.

Figure 5.5. Adding a Trust in the Web UI

[root@new_replica]# yum install ipa-server-trust-ad samba-client

1. Run the ipa-adtrust-install --add-agents command:

   [root@existing_trust_controller]# ipa-adtrust-install --add-agents

   The command enters interactive configuration session and prompts you for the information required to set up the agent.
   For further information about the --add-agents option, see the ipa-adtrust-install(1) man page.
2. Restart the IdM service:

   [root@existing_trust_controller]# ipactl restart

# ipa server-role-find | grep trust -B1 -A1
...
  Server name: new_replica.idm.example.comr
  Role name: AD trust agent
  Role status: enabled
...