Yes I kind of figured the Kerberos Interaction might be an issue...reading it
suggests its clearly better for the IPA master to do the DNS? so its seems
logical its a separate stub-zone..?
I have the rare opportunity to design from scratch....as the linux/unix
component of our site has no central system at all...but it has to inter-act
with AD and windows heavily. Its about a 30% ~70% split...over 500 servers.
What I dont want to have to do is re-configure it all later that would be a
nightmare I think....200 servers to change....ikky.
So we have multiple AD zones/domains,
example.ac.nz is the root AD
For windows AD.
Both sub-domains have passwords I need to get sync off
So I only want one Linux/unix domain....I dont want to split into staff. and
student. as that is being removed from our MS AD anyway...
So I want to make it as logical and easy as possible to admin and maintain for
our 1 linux admin.
Eventually we will just have example.ac.nz for AD but that's years away......in
which case eventually I would have example.ac.nz as AD syncing to
unix.example.ac.nz ? as the best solution?
This is better than running IPA under the main example.ac.nz? which is
controlled by AD.......
However I suspect that my management wont be happy if they see we have another
sub-domain.....its a marketing / image thing its not uh "professional"...so I
have to have good / clear reasons.
From: freeipa-users-boun...@redhat.com [freeipa-users-boun...@redhat.com] on
behalf of Simo Sorce [s...@redhat.com]
Sent: Wednesday, 4 May 2011 1:18 a.m.
Subject: Re: [Freeipa-users] Questions from Steven Jones
On Tue, 2011-05-03 at 08:46 -0400, Dmitri Pal wrote:
> I am posting Steven's questions as they have been sent to the wrong list
> and were on hold.
> Seem to be having issues posting....anyway....
> I notice that free-ipa really wants to work best as its own dns
> etc....problem is with AD running integrated DNS there is a clash....So
> Im wondering with say a domain of ipa.ac.nz whether it would be a good
> idea or sensible and worthwhile to run ipa as a dns stub say unix.ipa.ac.nz?
> Would this cause any issues with anything? say passwd syncing with AD
> under ipa.ac.nz (or actually its staff.ipa.ac.nz) ????
> >From reading the docs this looks like it might be a good idea, not sure...
> Are there any good high design and architecture docs I should read? to
> answer such Qs?
Having your own subdomain (or multiple subdomains) for IPA is certainly
a good idea. This is not much due to our DNS integration, you can
definitely handle DNS on your own, but has more to do with kerberos
libraries and the way realm -> domain mapping is done in some cases.
So if you organize your naming architecture to have IPA.EXAMPLE.COM ->
ipa.example.com then you get the best interoperability matrix between
That doesn't mean other combinations won't work, but you will have to
understand the details of how Keberos and DNS interrelate and how to
change client configuration if you choose different strategies.
Password syncing will have no problems related to DNS names, except,
perhaps for the need to change your SSL certificate (as X509 certs for
SSL embed the hostname of the server).
Simo Sorce * Red Hat, Inc * New York
Freeipa-users mailing list
Freeipa-users mailing list