I'm a little confused by that.

If I add the AD dc, will my client try to contact AD directly to get a
ticket?

Doesn't it have to do get the ticket through FreeIPA by proxy somehow?

And to confirm what you meant by add the AD dc and realm, it would be like
this ?

SUB.ADDOMAIN.NET = {
 kdc = dc1.addomain.net:88
}

I don't need the master_kdc, admin_server, default_domain entries?


> On Tue, May 05, 2015 at 09:53:38AM -0700, nat...@nathanpeters.com wrote:
>> Hmm, so if this is the [realms] section of my /etc/krb5.conf what do I
>> have to do ?
>>
>> [realms]
>>  IPADOMAIN.NET = {
>>   kdc = dc1.ipadomain.net:88
>>   master_kdc = dc1.ipadomain.net:88
>>   admin_server = dc1.ipadomain.net:749
>>   default_domain = ipadomain.net
>>   pkinit_anchors = FILE:/etc/ipa/ca.crt
>>   auth_to_local =
>> RULE:[1:$1@$0](^.*@SUB.ADDOMAIN.NET$)s/@SUB.ADDOMAIN.NET/@sub.addomain.net/
>>   auth_to_local = DEFAULT
>> }
>>
>> Would I just literally copy that section and change the names?
>> eg:
>>
>>  SUB.ADDOMAIN.NET = {
>>   kdc = dc1.ipadomain.net:88
>>   master_kdc = dc1.ipadomain.net:88
>>   admin_server = dc1.ipadomain.net:749
>>   default_domain = ipadomain.net
>
> you should add the AD DC and AD realm here
>
> The following lines you can just drop.
>
> HTH
>
> bye,
> Sumit



-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Reply via email to