First make sure you are allowed to create a trust. The admin user is the right choice in the default installation.
Then start your web browser and go to the IPA Web UI.
Select the IPA Server tab and choose the Trust section.
In the Add dialog you have to specific the name of the AD forest you want to trust.
To create the AD side of the trust credentials with sufficient privileges are needed.
Now IPA preforms the needs steps to establish and verify the trust.
You can check the properties of the trusted forest. Blacklists are used to filter unwanted Security Identifiers.
The other domains of the trusted forest can be found in the Trusted Domains tab.
To demonstrate the trust we switch to a Windows Client from the trusted forest.
Putty is called with an IPA host as target, but with the user name of the AD user and GSSAPI authentication enabled.
Without a password prompt the user is authenticated and logged in.
Now Kerberos tickets for the IPA host can be found on the AD side.
To enable access control we switch to the Policy tab of the IPA Web UI.
The allow_all HBAC rule is disabled and a more restrictive rule is enabled.
This rule only allows members of the ssh_users group to connect with ssh to any host in the IPA domain.
If we try to log in again from the Windows client we fail.
No other authentication is offered because GSSAPI authentication was successful but access was denied by the HBAC rule.