Configure sssd to work with multiple domains in different forests

Solution Verified - Updated -

Issue

  • How to authenticate users from AD domains belonging to different forests using SSSD
  • How to configure sssd so that it can fetch information from trusted AD domain belonging to different AD forest.
  • Can adcli be used to join two AD domains from different AD forest.
    • SSSD trusted domain support currently only includes retrieving information from domains within the same Active Directory Resource Forest. That being said, SSSD can be configured to resolve users and groups from more than one AD forest by configuring a domain for each forest in the SSSD configuration file.

NOTE: If expecting to use only shortnames(user, instead of user@domain) then user/group objects will be resolved in order of the domain sections specified in sssd.conf

Environment

  • Redhat Enterprise Linux 7
  • sssd
  • adcli
  • realmd
  • Active Directory

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.

Current Customers and Partners

Log in for full access

Log In