Re: [Freeipa-users] Two kerberos realms for same domainname?

2013-05-09 Thread Alexander Bokovoy
On Wed, 08 May 2013, Paul Robert Marino wrote: the client picks Realm based on the domain name of the host. you can control the behavior on the client via the KRB5.conf but the assumption is you have 1 realm per domain or host. From man krb5.conf DOMAIN_REALM SECTION The

Re: [Freeipa-users] Help troubleshooting migrate-ds

2013-05-09 Thread Arturo Borrero
On 07/05/13 22:04, Rob Crittenden wrote: https://fedorahosted.org/freeipa/ticket/3364 rob Thanks for poiting. It was the key. Now I'm having other issues, but the kind of issues I use to like :) Regards -- Arturo Borrero González Departamento de Seguridad Informática (n...@cica.es) Centro

Re: [Freeipa-users] Two kerberos realms for same domainname?

2013-05-09 Thread Johnny Westerlund
The problem i'm trying to solve is more of a design choice i guess. I would like to introduce RH Identity Management (IPA) since we need to handle authentication for *NIX machines. I guess i could integrate them towards Active Directory but i would rather enjoy all the benefits of running

Re: [Freeipa-users] FreeIPA Ldap Tree Entries

2013-05-09 Thread bwellsnc
Dimitri, Thanks for the info. I believe that I have what I need. Below is what I think should work. Thanks! dn: ou=People, cn=Schema Compatibility, cn=plugins, cn=config objectClass: top objectClass: extensibleObject ou: People schema-compat-container-group: cn=compat, dc=mydomain,dc=com

Re: [Freeipa-users] FreeIPA Ldap Tree Entries

2013-05-09 Thread bwellsnc
Ok, that did work, Now I have a new problem. I am receiving this error: Error: the plugin named cn=schema-compat-plugin-preop,cn=plugins,cn=config already exists. I think I have to redo what I created. Thanks for the help On Thu, May 9, 2013 at 7:54 AM, bwellsnc bwell...@gmail.com wrote:

Re: [Freeipa-users] Two kerberos realms for same domainname?

2013-05-09 Thread Paul Robert Marino
Well there are only two ways to do that.The first is to go "old school" and deploy static config files to your *NX hosts instead of utilizing the DNS to automatically configure them. On the bright side there are only a few files so its fairly strait forward and easy to do.The other way is to

Re: [Freeipa-users] Two kerberos realms for same domainname?

2013-05-09 Thread Simo Sorce
On Thu, 2013-05-09 at 09:03 +, Johnny Westerlund wrote: The problem i'm trying to solve is more of a design choice i guess. I would like to introduce RH Identity Management (IPA) since we need to handle authentication for *NIX machines. I guess i could integrate them towards Active

[Freeipa-users] Openldap import timeout

2013-05-09 Thread bwellsnc
I am seeing a timeout when I am trying to migrate from openldap to freeipa. ipa: ERROR: cannot connect to u'ldapi://%2fvar%2frun%2fslapd-MYDOMAIN-COM.socket': LDAP Server Down This looks like a problem on the IPA side since I have tried this against 3 different ldap servers and I get the same