Red Hat Summit Red Hat Summit지원콘솔개발자평가판 시작연락처

10장. Troubleshooting setting up a cross-forest trust

Learn more about troubleshooting the process of configuring a cross-forest trust between your Identity Management (IdM) environment and an Active Directory (AD) forest.

10.1. Sequence of events when establishing a cross-forest trust with AD
링크 복사

When you use the ipa trust-add command to establish a cross-forest trust with an Active Directory (AD) Domain Controller (DC), the command operates on behalf of the user who ran the command and performs the following actions on the IdM server. If you have trouble establishing a cross-forest trust, you can use this list to help narrow down and troubleshoot your issue.

Part 1: The command verifies settings and inputs
  1. Verify that the IdM server has the Trust Controller role.
  2. Validate the options passed to the ipa trust-add command.
  3. Validate the ID range associated with a trusted forest root domain. If you did not specify the ID range type and properties as options to the ipa trust-add command, they are discovered from Active Directory.
Part 2: The command attempts to establish a trust to an Active Directory domain
  1. Create a separate trust object for each trust direction. Each of the objects get created on both sides (IdM and AD). If you are establishing a one-way trust, only one object is created on each side.

  2. The IdM server uses the Samba suite to handle domain controller capabilities for Active Directory and creates a trust object on the target AD PDC:

    1. The IdM server establishes a secure connection to the IPC$ share on the target DC. Since RHEL 8.4, the connection requires at least the SMB3 protocol with Windows Server 2012 and above to ensure the connection is sufficiently secure with AES-based encryption used for the session.
    2. The IdM server queries for the presence of the trusted domain object (TDO) using an LSA QueryTrustedDomainInfoByName call.

    3. If the TDO is already present, remove it with an LSA DeleteTrustedDomain call.

      참고

      This call fails if the AD user account used to establish the trust does not have full Enterprise Admin (EA) or Domain Admin (DA) privileges for the forest root, such as members of the Incoming Forest Trust Builders group. If the old TDO is not automatically removed, an AD Administrator must manually remove it from AD.

    4. The IdM server creates a new TDO with an LSA CreateTrustedDomainEx2 call. The TDO credentials are randomly generated using a Samba-provided password generator with 128 random characters.

    5. The new TDO is then modified with an LSA SetInformationTrustedDomain call to make sure encryption types supported by the trust are set properly:

      1. The RC4_HMAC_MD5 encryption type is enabled, even if there are no RC4 keys in use, due to how Active Directory is designed.
      2. AES128_CTS_HMAC_SHA1_96 and AES256_CTS_HMAC_SHA1_96 encryption types are enabled.
  3. For a forest trust, verify that in-forest domains can be reached transitively with an LSA SetInformationTrustedDomain call.

  4. Add trust topology information about the other forest (IdM in the case of communicating with AD, AD in the case of communicating with IdM) using an LSA RSetForestTrustInformation call.

    참고

    This step might cause a conflict for one of three reasons:

    • A SID namespace conflict, reported as an LSA_SID_DISABLED_CONFLICT error. This conflict cannot be resolved.
    • A NetBIOS namespace conflict, reported as an LSA_NB_DISABLED_CONFLICT error. This conflict cannot be resolved.
    • A DNS namespace conflict with a top level name (TLN), reported as an LSA_TLN_DISABLED_CONFLICT error. The IdM server can automatically resolve a TLN conflict if it is caused by another forest.

    To resolve a TLN conflict, the IdM server performs the following steps:

    1. Retrieve forest trust information for the conflicting forest.
    2. Add an exclusion entry for the IdM DNS namespace to the AD forest.
    3. Set forest trust information for the forest we conflict on.
    4. Re-try establishing the trust to the original forest.

    The IdM server can only resolve these conflicts if you authenticated the ipa trust-add command with the privileges of an AD administrator that can change forest trusts. If you do not have access to those privileges, the administrator of the original forest must manually perform the steps above in the Active Directory Domains and Trusts section of the Windows UI.

  5. If it does not exist, create the ID range for the trusted domain.
  6. For a forest trust, query Active Directory domain controllers from the forest root for details about the forest topology. The IdM server uses this information to create additional ID ranges for any additional domains from the trusted forest.
Red Hat logoGithubredditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다. 최신 업데이트를 확인하세요.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

Theme

© 2026 Red Hat맨 위로 이동