On Няд, 07 чэр 2026, Olivier G via FreeIPA-users wrote:
Hi,
Thanks a lot for your answer. I forgot to mention that I had already
read your document but I wasn't sure I understood correctly hence my
question.
The second part of your document speaks about DNS view which I thought
is different than completely splitting environments but do you confirm
that it's not : FreeIPA requires to be accessed only one network
interface ?
There is explicit no support for multiple network interfaces in IPA.
Hostname is considered global (e.g. master.ipa.test is always
master.ipa.test even if you have multiple IP addresses associated),
daemons bind to 0.0.0.0 on IPv4 or to :: on IPv6. This means they can be
reached through all external interfaces if firewalls do not prevent it
but they would only resolve to a single hostname where protocols expect
it: single DNS name in TLS certificates, single Kerberos principal for
GSSAPI is present in the keytab. When response is sent, the kernel will
decide from which external address that connection will be served, not
IPA daemons.
For these conditions you might assume there is a rudimentary support for
multiple network interfaces. Nothing more specific could be added
without implementing missing bits described in my blog.
I would certainly not build your deployment architecture on this fact.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
--
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
