About setting trusted domains
The Microsoft Active Directory supports the concept of trusted domains. When you authenticate users, you can configure domain controllers in one domain to trust the domain controllers in another domain. This establishes the trust relation between the two domains. When Access Appliance is a member in an AD domain, both Access Appliance and the domain controller are involved in authenticating the clients. You can configure Access Appliance to support or not support trusted domains.
You can obtain unique user IDs (UIDs) or group IDs (GIDs) from domains by reading ID mappings from an Active Directory server that uses RFC2307/SFU schema extensions. This is a read-only idmap backend..
A valid user from a domain or trusted domain should have a UID as well as a GID for the user's primary group.
By default, the uid_range is set to 10000-1000000. Change it in cases where there are more than 1,000,000 users existing on a local Access Appliance cluster where there are joined Active Directory domains or trusted domains.
Note:
The uid_range is adjusted automatically according to the search results of the defined UNIX IDs from the domain after a CIFS server restart.
Table: Set trusted domains commands
Command | Definition |
|---|---|
set allow_trusted_domains yes | Enables the use of trusted domains in the AD domain mode. Note: If the security mode is user, it is not possible to enable AD trusted domains. All the IDMAP backend methods (rid, ldap, and hash) are able to support trusted domains. |
set allow_trusted_domains no | Disables the use of trusted domains in the AD domain mode. |