Running FreeIPA next to Active Directory: trust types, ID mapping, ID views, AD users on Linux, DNS, supported Windows versions and what Windows machines can and cannot do.
Choosing the trust direction for FreeIPA and AD: what AD users and IdM users can reach in each, Kerberos FAST and why it can force a two-way trust, and the effect on two-factor authentication.
Deciding how AD users get UIDs and GIDs in FreeIPA: ipa-ad-trust ranges that map from SIDs, ipa-ad-trust-posix ranges that read AD POSIX attributes, auto private groups, and why the choice is hard to change later.
Overriding UIDs, shells, home directories and SSH keys for AD users on specific FreeIPA hosts with ID views and ID overrides, and keeping overrides manageable.
Letting AD users and groups log in to Linux and run sudo under FreeIPA policy: external groups, HBAC rules, sudo rules that reference AD objects, and testing access.
Creating a one-way FreeIPA to AD trust without giving FreeIPA admins AD domain admin credentials: each side configures its half, validation, and coordinating with the AD team.
Placing trust controllers and agents in a FreeIPA topology: what each role does, the recommended count per deployment and data center, Kerberos limits on agents, and packages required.
Getting DNS right before a FreeIPA trust: separate primary domains, SRV records, forward zones for the AD domain, realm and NetBIOS naming rules, and checks from both sides.
Replacing deprecated WinSync user synchronization with a cross-forest trust: the WinSync limits, duplicated users, PassSync agents, and the cutover steps for Linux access.
Which AD forest and domain functional levels and domain controller versions work with FreeIPA trusts, the RHEL versions needed for Windows Server 2022 and 2025, and SMB encryption requirements.
What Windows machines can and cannot do with FreeIPA: no domain join, AD trust for Windows users, Samba file servers on IPA clients, and the architecture for mixed Linux and Windows estates.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.