I'm looking for a bit of direction around the best way to configure/setup an
on-site cache &/or replica from an AD Server which will be uni-directional (AD
The master are multiple AD Servers located around the place, and we exist in a
place which is outside of the core network and that network link is a single
point of failure.
What I want to achieve is in the event we lose connectivity with the world
users can still authenticate, but if someone is disabled/updated at the top
level it replicates down. I've got a test AD Server & have been reviewing IPA,
but have hit an issue in that I can't get software installed on the AD Masters
for the 389 dir sync software.
Currently I've configured a synchronization based solution with one way
replication from the AD Masters -> IPA. This works fine and I can see all the
users being created in IPA - but as the passwords can't be synced without
installing software I can't use this method.
Another nice thing would be to have a separate domain/tree available so we can
split up the staff that are from the master servers and some client related
user/passes that won't be in the Global Directory - but managed from the same
Are there any other setup's that will achieve what I require? Have seen slapd
with proxy cache but I'm not sure on this options either and configuring slapd
with all the ldif files manually seems a little daunting at first sight.
Thanks in advance,
This email and any attachments may contain confidential and proprietary
information of Blackboard that is for the sole use of the intended recipient.
If you are not the intended recipient, disclosure, copying, re-distribution or
other use of any of this information is strictly prohibited. Please immediately
notify the sender and delete this transmission if you received this email in
Manage your subscription for the Freeipa-users mailing list:
Go to http://freeipa.org for more info on the project