No, unless you can alias them in the KDC.
Our KDC can technically supports aliases now, but we haven't added these
kind of aliases yet to it. And it is a bit controversial on whether we
want to.

In A windows domain you simply cannot have client residing in a DNA
domain that is not the same as the domain controller. This is a pretty
hard limitation and we do not want to add it to FreeIPA.

Now why does it matter in this case ?
It matter because, by forcing a single DNS Domain windows can univocally
say a<->  a.b.c given the b.c part is forced on all clients joined to
that domain.
This does not hold true for FreeIPA. You could have foo.bar.example.com
and foo.rab.example.com ie 2 host with the same short name but in
different subdomains. if we alias both foo's and then we try to obtain a
ticket for host/foo@REALM then the KDC does not know which foo you refer
to. And if we alias only one then the second foo will simply fail to use
the shortname.

So the solution is to always use fully qualified names, which seem a
pretty decent compromise that shouldn't really cause issues in the vast
majority of cases.

Simo.

I understand now, thanks. But still I see 2 limitations in this:
1. I dare to say most people do not care that they CAN join foo.rab.example.com machine to the bar.example.com domain - to me, it is only confusing. In fact, this is a complete new information to me. I still believe we should produce at least a small warning if we find that DNS domain <> IPA domain.
2. You see problems like this - there is nowhere said that your `hostname` must 
be FQDN as the OS itself happily accept both.

Either case, the ipa-client-install script should be able to detect such a case and offer some solution at least (I have a faint feeling there is even BZ already opened against this).

Ondrej


Proud winners of the prestigious Irish Software Exporter Award 2011 from Irish 
Exporters Association (IEA).  Please, refer to our web site for more details 
regarding the award.
--------
The information contained in this e-mail and in any attachments is confidential 
and is designated solely for the attention of the intended recipient(s). If you 
are not an intended recipient, you must not use, disclose, copy, distribute or 
retain this e-mail or any part thereof. If you have received this e-mail in 
error, please notify the sender by return e-mail and delete all copies of this 
e-mail from your computer system(s).
Please direct any additional queries to: communicati...@s3group.com.
Thank You.
Silicon and Software Systems Limited. Registered in Ireland no. 378073.
Registered Office: South County Business Park, Leopardstown, Dublin 18
_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Reply via email to