Applies to:
All versions of Centrify DirectControl.
Question:
Does Centrify support UNIX enabling a group from another forest similar to the way it allows users?. Using the Centrify DirectControl Console, the option to add group is grayed out.
Answer:
Yes, we allow unix-enabling of group from resource forest if its a two-way trust between the 2 forests.
Note: Centrify DirectControl Console (without ZPA enabled) will not allow you to add groups across a 1-way trust. A question may be asked "Why groups from a one-way trusted forest can not be used with Centrify DirectControl". See below for an explanation.
The definition of a one-way outgoing trust is that users in the trusted domain can be authenticated in the current domain, but the current domain is not trusted in reverse. This means that principals which are members of the current domain (such as the Centrify server) do not have permissions to read data from the trusted domain. In order to enable this, a two-way trust must be created. Since by definition, the group object in the trusted domain is not readable by the Unix computer principal, this group cannot be used.
Note: ZPA (Zone Provisioning Agent) which automates the process of adding users/groups has a known bug which does allow groups from remote forest in a 1-way trust. See KB (KB-1791: Why does ZPA allow groups to be added from accounts domain in a 1-way trust?) for more details.
For more information on how ZPA works, please check out the documentation in the below URL. This URL requires Centrify support credentials to view the same.
http://www.centrify.com/downloads/products/documentation/suite2011/ga/centrify-zpa-admin-guide.pdf