gc-wip: windows can not obtain FQDN for IPA user

abbra / freeipa

Mirror of FreeIPA, an integrated security information management solution

http://www.freeipa.org

GNU General Public License v3.0

2 stars 1 forks source link

gc-wip: windows can not obtain FQDN for IPA user #64

Open wladich opened 3 years ago

wladich commented 3 years ago

I have logged in as IPA user at Windows AD client machine. When I execute whoami /upn I get expected result: admin@testrelm.test. But when I run whoami /fqdn I get the error:

ERROR: Unable to get Fully Qualified Distinguished Name (FQDN) as the current
       logged-on user is not a domain user.

For reference: same command output for AD user:

whoami /fqdn
CN=testuser,CN=Users,DC=ad,DC=test

abbra commented 3 years ago

I believe this is just OK. We do not support [MS-DRSR] RPC API, so there is no way to run FQDN request like in the example here: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/1c8421eb-2f6c-476c-a7d0-fe93277001ec

This is due to our use of Samba -- we use it as an NT4 domain controller with enough plumbing to believe we are an AD DC for forest trust but we don't have fully working AD DC. Samba provides implementation of MS-DRSR protocol only when it is running as AD DC. We cannot run it in this mode because it uses incompatible schema with FreeIPA and cannot look up data in FreeIPA LDAP server.