Hi, Yes I kind of figured the Kerberos Interaction might be an issue...reading it suggests its clearly better for the IPA master to do the DNS? so its seems logical its a separate stub-zone..?
I have the rare opportunity to design from scratch....as the linux/unix component of our site has no central system at all...but it has to inter-act with AD and windows heavily. Its about a 30% ~70% split...over 500 servers. What I dont want to have to do is re-configure it all later that would be a nightmare I think....200 servers to change....ikky. So we have multiple AD zones/domains, example.ac.nz is the root AD staff. student. For windows AD. Both sub-domains have passwords I need to get sync off So I only want one Linux/unix domain....I dont want to split into staff. and student. as that is being removed from our MS AD anyway... So I want to make it as logical and easy as possible to admin and maintain for our 1 linux admin. Eventually we will just have example.ac.nz for AD but that's years away......in which case eventually I would have example.ac.nz as AD syncing to unix.example.ac.nz ? as the best solution? This is better than running IPA under the main example.ac.nz? which is controlled by AD....... However I suspect that my management wont be happy if they see we have another sub-domain.....its a marketing / image thing its not uh "professional"...so I have to have good / clear reasons. regards ________________________________________ From: freeipa-users-boun...@redhat.com [freeipa-users-boun...@redhat.com] on behalf of Simo Sorce [s...@redhat.com] Sent: Wednesday, 4 May 2011 1:18 a.m. To: d...@redhat.com Cc: email@example.com Subject: Re: [Freeipa-users] Questions from Steven Jones On Tue, 2011-05-03 at 08:46 -0400, Dmitri Pal wrote: > I am posting Steven's questions as they have been sent to the wrong list > and were on hold. > > ------------------------------------------------ > > Hi > > Seem to be having issues posting....anyway.... > > I notice that free-ipa really wants to work best as its own dns > etc....problem is with AD running integrated DNS there is a clash....So > Im wondering with say a domain of ipa.ac.nz whether it would be a good > idea or sensible and worthwhile to run ipa as a dns stub say unix.ipa.ac.nz? > > Would this cause any issues with anything? say passwd syncing with AD > under ipa.ac.nz (or actually its staff.ipa.ac.nz) ???? > > >From reading the docs this looks like it might be a good idea, not sure... > > Are there any good high design and architecture docs I should read? to > answer such Qs? Having your own subdomain (or multiple subdomains) for IPA is certainly a good idea. This is not much due to our DNS integration, you can definitely handle DNS on your own, but has more to do with kerberos libraries and the way realm -> domain mapping is done in some cases. So if you organize your naming architecture to have IPA.EXAMPLE.COM -> ipa.example.com then you get the best interoperability matrix between all components. That doesn't mean other combinations won't work, but you will have to understand the details of how Keberos and DNS interrelate and how to change client configuration if you choose different strategies. Password syncing will have no problems related to DNS names, except, perhaps for the need to change your SSL certificate (as X509 certs for SSL embed the hostname of the server). Simo. -- Simo Sorce * Red Hat, Inc * New York _______________________________________________ Freeipa-users mailing list Freeipafirstname.lastname@example.org https://www.redhat.com/mailman/listinfo/freeipa-users _______________________________________________ Freeipa-users mailing list Freeipaemail@example.com https://www.redhat.com/mailman/listinfo/freeipa-users