# Demo of IPA-IPA trust

Requires two IPA deployments which already set up, IPA1.TEST and IPA2.TEST.

In order to test IPA-IPA trust, packages from COPR repository
abbra/ipa-ipa-trust must be installed.

Currently there should be at least one master in each deployment:

- master1.ipa1.test in IPA1.TEST, with ipa-adtrust-install ran on it

- master2.ipa2.test in IPA2.TEST, with ipa-adtrust-install ran on it

Ansible configuration is provided in ansible.cfg, make sure to change it
according to your environment.

Ansible inventory is provided in servers.inventory. Make sure to update system
IP addresses properly.

## Demo

To run the demo, use

    $ ansible-playbook -i servers.inventory trust-to-ipa.yml

This playbook will perform following operations:

- clean up older data from the master1.ipa1.test and master2.ipa2.test

- collect information about the environments

- establish bidirectional trust between IPA1.TEST and IPA2.TEST

- add ID range for IPA1.TEST on IPA2.TEST deployment

- fix up trust details on IPA2.TEST

- clean up SSSD caches on both masters

- run lookup of IPA2.TEST users and groups on IPA1.TEST

- run lookup of IPA1.TEST users and groups on IPA2.TEST

## Establishing trust

The process to establish trust will change. Current approach utilizes the same
logic FreeIPA has for trust to Active Directory. In future, a process to
establish trust will look similarly but will not rely on existence of Samba DC.

## Features to test

Once playbook is completed, both environments should be ready to resolve users
and groups from the trusted domains. All operations available for trust to
Active Directory can be performed against trust to IPA as well:

- trusted IPA users and groups can be added as external members of external
  (non-POSIX) groups

- External groups can be added as members of POSIX groups

- SUDO rules and HBAC rules can be applied via external group membership

- trusted IPA users and groups can be handled in ID overrides

- trusted IPA user can be added to ID overrides in 'Default Trust View' to
  allow login to Web UI

- ID overrides in 'Default Trust View' can be added as members of IPA groups
  to allow permissions/roles to apply

