Hi Siggi,

I see and agree fully - we need something like this...

Ondrej

On 10/20/2011 11:55 AM, Sigbjorn Lie wrote:
Hi Ondrej,

Thanks. That RFE is for SSSD client only. I would like to see the management of 
sites within the
IPA webui/cli.




Regards,
Siggi


On Thu, October 20, 2011 09:02, Ondrej Valousek wrote:
I have come across this already, BZ already created:


https://fedorahosted.org/sssd/ticket/1032


On 10/19/2011 10:25 PM, Sigbjorn Lie wrote:

The London/newyork dns sub-domains would be used for looking up srv records for 
the local
kerberos/ldap servers only. The actual domain configured on the client and the 
kerberos and LDAP
  base would still be the ipa.domain.com.

Sync with AD would still be done between ipa.domain.com<->   ad.domain.com.



Rgds,
Siggi



On Wed, October 19, 2011 22:15, Steven Jones wrote:

Ah right, yes, one realm.



However how would you password sync with AD?



So say    London.ad.ms.com  and Newyork.ad.ms.com



With NY as the "head"



So with london.ipa.unix.com and newyork.ipa.unix.com



Is there still only one winsync agreement?





regards

Steven Jones



Technical Specialist - Linux RHCE



Victoria University, Wellington, NZ



0064 4 463 6272



________________________________________
From: Sigbjorn Lie [sigbj...@nixtra.com]
Sent: Thursday, 20 October 2011 9:11 a.m.
To: Steven Jones
Cc: freeipa-users@redhat.com
Subject: RE: [Freeipa-users] The concept of sites...



I see your point with a messy dns infrastructure, however this would happen in 
the
background.


You would still only have one kerberos realm per IPA instance.




Rgds,
Siggi






On Wed, October 19, 2011 21:30, Steven Jones wrote:


Hi,




I think AD sort of does this which they have now backed away from?




 From my very limited understanding having sub-domains/realms seems to be
counter-productive....in that trying to do cross-realm trusts/passwords/user 
info becomes a
nightmare?

I know somehow I have to get unix.vuw.ac.nz to talk to staff.vuw.ac.nz and
student.vuw.ac.nz in a winsync (password) agreement, I dont know even if that's 
possible?
Yet with a flat domain to
flat domain its easy?

regards

Steven Jones




Technical Specialist - Linux RHCE




Victoria University, Wellington, NZ




0064 4 463 6272




________________________________________
From: freeipa-users-boun...@redhat.com [freeipa-users-boun...@redhat.com] on 
behalf of
Sigbjorn
Lie [sigbj...@nixtra.com]
Sent: Thursday, 20 October 2011 8:14 a.m.
To: freeipa-users@redhat.com
Subject: [Freeipa-users] The concept of sites...




Hi,




Has there been given any thought to the concept of sites within IPA to
improve cross-site implementations? This should be easy to implement as you are 
already
using DNS
SRV records to locate the ldap/kerberos servers.




E.g.
Site: Boston
Site: London





Create a subdomain of the IPA dns domain named _sites, and a subdomain
of _sites for each site.

Boston._sites.ipa.domain.com would contain the srv entries for IPA
servers in Boston: _ldap._tcp        in    srv    0 100 389 boston-ipa-server1 
_ldap._tcp in
srv    0 100 389 boston-ipa-server2 .....



London._sites.ipa.domain.com would contain the srv entries for IPA
serers in London: _ldap._tcp        in    srv    0 100 389 london-ipa-server1 
_ldap._tcp in
srv    0 100 389 london-ipa-server2 ....



Now point the client's DNS "search" entry to point to the local site
first, then search the full name space: Boston client's /etc/resolv.conf: search
Boston._sites.ipa.domain.com ipa.domain.com



London client's /etc/resolv.conf:
search London._sites.ipa.domain.com ipa.domain.com


The main ipa.domain.com could still contain srv records for all IPA
servers, or selected IPA servers at the central hub.

I know I can do this manually within the DNS managment in IPA today,
however it would be a lot easier to maintain "Sites" within the IPA webui/cli. 
*blink* ;)

What's your thoughts on this?






Regards,
Siggi






_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users





_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users


The information contained in this e-mail and in any attachments is confidential 
and is designated
solely for the attention of the intended recipient(s). If you are not an 
intended recipient, you
must not use, disclose, copy, distribute or retain this e-mail or any part 
thereof. If you have
received this e-mail in error, please notify the sender by return e-mail and 
delete all copies of
this e-mail from your computer system(s). Please direct any additional queries 
to:
communicati...@s3group.com. Thank You.
Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 
378073.
Registered Office: South County Business Park, Leopardstown, Dublin
18_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users



The information contained in this e-mail and in any attachments is confidential 
and is designated solely for the attention of the intended recipient(s). If you 
are not an intended recipient, you must not use, disclose, copy, distribute or 
retain this e-mail or any part thereof. If you have received this e-mail in 
error, please notify the sender by return e-mail and delete all copies of this 
e-mail from your computer system(s).
Please direct any additional queries to: communicati...@s3group.com.
Thank You.
Silicon and Software Systems Limited (S3 Group). Registered in Ireland no. 
378073.
Registered Office: South County Business Park, Leopardstown, Dublin 18
_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Reply via email to