Yes I kind of figured the Kerberos Interaction might be an issue...reading it 
suggests its clearly better for the IPA  master to do the DNS? so its seems 
logical its a separate stub-zone..?

I have the rare opportunity to design from scratch....as the linux/unix 
component of our site  has no central system at all...but it has to inter-act 
with AD and windows heavily.   Its about a 30% ~70% split...over 500 servers.

What I dont want to have to do is re-configure it all later that would be a 
nightmare I think....200 servers to change....ikky.

So we have multiple AD zones/domains,

example.ac.nz  is the root AD

For windows AD.

Both sub-domains have passwords I need to get sync off 

So I only want one Linux/unix domain....I dont want to split into staff. and 
student. as that is being removed from our MS AD anyway...

So I want to make it as logical and easy as possible to admin and maintain for 
our 1 linux admin.

Eventually we will just have example.ac.nz for AD but that's years away......in 
which case eventually I would have  example.ac.nz as AD syncing to 
unix.example.ac.nz ? as the best solution?

This is better than running IPA under the main example.ac.nz?  which is 
controlled by AD.......

However I suspect that my management wont be happy if they see  we have another 
sub-domain.....its a marketing / image thing its not uh "professional"...so I 
have to have good / clear reasons. 


From: freeipa-users-boun...@redhat.com [freeipa-users-boun...@redhat.com] on 
behalf of Simo Sorce [s...@redhat.com]
Sent: Wednesday, 4 May 2011 1:18 a.m.
To: d...@redhat.com
Cc: freeipa-users@redhat.com
Subject: Re: [Freeipa-users] Questions from Steven Jones

On Tue, 2011-05-03 at 08:46 -0400, Dmitri Pal wrote:
> I am posting Steven's questions as they have been sent to the wrong list
> and were on hold.
> ------------------------------------------------
> Hi
> Seem to be having issues posting....anyway....
> I notice that free-ipa really wants to work best as its own dns
> etc....problem is with AD running integrated DNS there is a clash....So
> Im wondering with say a domain of ipa.ac.nz whether it would be a good
> idea or sensible and worthwhile to run ipa as a dns stub say unix.ipa.ac.nz?
> Would this cause any issues with anything? say passwd syncing with AD
> under ipa.ac.nz  (or actually its staff.ipa.ac.nz)  ????
> >From reading the docs this looks like it might be a good idea, not sure...
> Are there any good high design and architecture docs I should read?  to
> answer such Qs?

Having your own subdomain (or multiple subdomains) for IPA is certainly
a good idea. This is not much due to our DNS integration, you can
definitely handle DNS on your own, but has more to do with kerberos
libraries and the way realm -> domain mapping is done in some cases.

So if you organize your naming architecture to have IPA.EXAMPLE.COM ->
ipa.example.com then you get the best interoperability matrix between
all components.

That doesn't mean other combinations won't work, but you will have to
understand the details of how Keberos and DNS interrelate and how to
change client configuration if you choose different strategies.

Password syncing will have no problems related to DNS names, except,
perhaps for the need to change your SSL certificate (as X509 certs for
SSL embed the hostname of the server).


Simo Sorce * Red Hat, Inc * New York

Freeipa-users mailing list

Freeipa-users mailing list

Reply via email to