Thank you and sorry for the mess.
have a look at the Identity Collector Alias Feature (Identity Awareness R80.20 Administration Guide), maybe pdp will query the right Account Unit if you map X.COM to Y.COM.
Indeed, it looks like it is as simple as that... I've configured an Alias (X.COM=Y.COM) and now my gateways are fetching the user's groups on the right domain/DC.
I still have some testing to make to be sure, but right now it's working!
It sounds like if I understood the setup, you would need to integrate domain Y into IDC and gateway rather than X. Domain Y still would have user and machine names to form groups? So you could build access roles based on AD-Y users, machines and groups.
By the way, I have a final question.
To get the groups I can either use ActiveDirectory or OpenLDAP (which are syncronised with the same informations).
With the ActiveDirectory I have no problem to make it work, however I couldn't make it with the OpenLDAP.
Do you know if OpenLDAP is supported for this use case?
I've seen somewhere that I might need an additionnal licence to do that ("User Directory"), but I'am not sure about that.
I don't believe there is anything about OpenLDAP that would make it inherently not work.
That said, I don't think we (or anyone else) has figured out how to make it work yet.
I'm facing some problems again and this time I can figure out why it is not working.
I'am actually getting the identities from 2 differents domains.
For one, everything is working smoothly.
But for the other, I'am "Connected" to the DCs and everything is green in the IDC, however I'm not getting any Events (it stays at "0").
I've been looking at the debug files for hours but I can't figure out why it's not working.
Any idea how to debug that?
One thing that came to my mind is that this Domain is an old "Single label domain name" (like "PRIV" is the full domain name).
Is it possible that this is not supported by the IDC?
Does anyone has faced this case?
I'am still blocked on this even though i tried everything i could on the AD side : nothing to do -> 0 events are detected by the IDC... Knowing that there is at least 5k employees using this AD for login purpose, something is obviously going on.
Thx in advance to anyone that light have information about this particular scénario..
Thank you all for the great answers.
I could manage to make it works as i wanted with the Alias feature.
However, I also had to put a specific filter because after enabling the Alias feature (as X.COM=Y.COM), the IDC started to send me every association in double (one request as user@X.COM and one request as user@Y.COM). The problem is that when I receive the X.COM as the second request, domain is unknown and association is dropped. It works with the filter though.
Everytime I get a "Wrong argument format!" whatever I try. I will handle that with a Cron.
have you managed somehow issue with pdp update refetch_interval set 600? I wanna change it as well and that cmd is even undocumented in IA guide for r80.20..
Still haven't found any way to make it works.
I managed to do that with a cron until I find any clue how to use this commande..
As for "pdp update refetch_interval set" command, it seems that we have an issue with it in R80.20 and we will fix it in one of the next Jumbo Fixes.
To set the value without using the command, edit the file pdp_overriding_attrs.C , it should be located in $FWDIR/conf/pdp_overriding_attrs.C or create it.
It is recommended to backup the file if it already exists before editing.
ok this is working, tested today..