diff --git a/guides/common/assembly_configuring-active-directory-as-an-external-identity-provider-for-project.adoc b/guides/common/assembly_configuring-active-directory-as-an-external-identity-provider-for-project.adoc index 0e5201251b3..57abef317cb 100644 --- a/guides/common/assembly_configuring-active-directory-as-an-external-identity-provider-for-project.adoc +++ b/guides/common/assembly_configuring-active-directory-as-an-external-identity-provider-for-project.adoc @@ -7,5 +7,3 @@ include::modules/proc_enrolling-server-with-the-ad-server.adoc[leveloffset=+1] include::modules/proc_configuring-direct-ad-integration-with-gss-proxy.adoc[leveloffset=+1] include::modules/con_kerberos-configuration-in-web-browsers.adoc[leveloffset=+1] - -include::modules/proc_configuring-the-freeipa-server-to-use-cross-forest-trust.adoc[leveloffset=+1] diff --git a/guides/common/modules/proc_configuring-the-freeipa-server-to-use-cross-forest-trust.adoc b/guides/common/modules/proc_configuring-the-freeipa-server-to-use-cross-forest-trust.adoc deleted file mode 100644 index efe826486dd..00000000000 --- a/guides/common/modules/proc_configuring-the-freeipa-server-to-use-cross-forest-trust.adoc +++ /dev/null @@ -1,32 +0,0 @@ -[id="Configuring_the_FreeIPA_Server_to_use_Cross_Forest_Trust_{context}"] -= Configuring the {FreeIPA} server to use cross-forest trust - -On the {FreeIPA} server, configure the server to use `cross-forest trust`. - -.Procedure -. Enable HBAC: -.. Create an external group and add the AD group to it. -.. Add the new external group to a POSIX group. -.. Use the POSIX group in a HBAC rule. -. Configure sssd to transfer additional attributes of AD users. -* Add the AD user attributes to the _nss_ and _domain_ sections in `/etc/sssd/sssd.conf`. -For example: -+ -[options="nowrap", subs="+quotes,verbatim,attributes"] ----- -[nss] -user_attributes=+mail, +sn, +givenname -[domain/EXAMPLE.com] -... -krb5_store_password_if_offline = True -ldap_user_extra_attrs=email:mail, lastname:sn, firstname:givenname - -[ifp] -allowed_uids = ipaapi, root -user_attributes=+email, +firstname, +lastname ----- -* Verify the AD attributes value. -+ ----- -# dbus-send --print-reply --system --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe org.freedesktop.sssd.infopipe.GetUserAttr string:ad-user@ad-domain array:string:email,firstname,lastname -----