On 2022-12-14 14:48, Alexander Bokovoy via FreeIPA-users wrote:
On ke, 14 joulu 2022, Carlos Mogas da Silva wrote:
# egrep -v "^\s*#|^$" /var/lib/sss/pubconf/krb5.include.d/*
/var/lib/sss/pubconf/krb5.include.d/domain_realm_int_r3pek_org:[domain_realm]
/var/lib/sss/pubconf/krb5.include.d/krb5_libdefaults:[libdefaults]
/var/lib/sss/pubconf/krb5.include.d/krb5_libdefaults: canonicalize =
true
/var/lib/sss/pubconf/krb5.include.d/localauth_plugin:[plugins]
/var/lib/sss/pubconf/krb5.include.d/localauth_plugin: localauth = {
/var/lib/sss/pubconf/krb5.include.d/localauth_plugin: module =
sssd:/usr/lib64/sssd/modules/sssd_krb5_localauth_plugin.so
/var/lib/sss/pubconf/krb5.include.d/localauth_plugin: }
While also testing some stuff out, if I force the IP address of the
mail01.r3pek.org server to be the internal one, the auth works. Am I
missing something or is the normal?
You have canonicalization set to true, this is default configuration in
IPA, so krb5 will do 'mail01.int.r3pek.org' -> IP address -> hostname
transformation. This means whatever hostname is obtained afterwards is
used then. If it is mail01.r3pek.org, then Kerberos realm of r3pek.org
domain would be used. Is it R3PEK.ORG or INT.R3PEK.ORG? It can be
changed via _kerberos TXT record.
Well, the external domain is mail01.r3pek.org, which has the public IPs.
The REALM and the internal domains are INT.R3PEK.ORG. Email domains are
@r3pek.org
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue
