Hey All,

I'm looking for a bit of direction around the best way to configure/setup an 
on-site cache &/or replica from an AD Server which will be uni-directional (AD 
-> IPA/slapd)

The master are multiple AD Servers located around the place, and we exist in a 
place which is outside of the core network and that network link is a single 
point of failure.

What I want to achieve is in the event we lose connectivity with the world 
users can still authenticate, but if someone is disabled/updated at the top 
level it replicates down. I've got a test AD Server & have been reviewing IPA, 
but have hit an issue in that I can't get software installed on the AD Masters 
for the 389 dir sync software.

Currently I've configured a synchronization based solution with one way 
replication from the AD Masters -> IPA. This works fine and I can see all the 
users being created in IPA - but as the passwords can't be synced without 
installing software I can't use this method.

Another nice thing would be to have a separate domain/tree available so we can 
split up the staff that are from the master servers and some client related 
user/passes that won't be in the Global Directory - but managed from the same 

Are there any other setup's that will achieve what I require? Have seen slapd 
with proxy cache but I'm not sure on this options either and configuring slapd 
with all the ldif files manually seems a little daunting at first sight.

Thanks in advance,

This email and any attachments may contain confidential and proprietary 
information of Blackboard that is for the sole use of the intended recipient. 
If you are not the intended recipient, disclosure, copying, re-distribution or 
other use of any of this information is strictly prohibited. Please immediately 
notify the sender and delete this transmission if you received this email in 
Manage your subscription for the Freeipa-users mailing list:
Go to http://freeipa.org for more info on the project

Reply via email to