On 13/12/16 07:52, Stephen Ingram wrote:
On Sun, Dec 11, 2016 at 11:31 PM, David Kupka <dku...@redhat.com> wrote:

yes you can do it. DNS domain and Kerberos realm are two different things.
It's common and AFAIK recommended to capitalize DNS domain to get the realm
but it's not required.
If you really want to have them different make sure:
a) anotherdomain.com is under your control,
b) you don't already have other Kerberos instance (FreeIPA, MIT KRB5, MS
AD, ...) with ANOTHERDOMAIN.COM <http://anotherdomain.com/> realm

With FreeIPA you can run
# ipa-server-install --domain example.com --realm ANOTHERDOMAIN.COM

But before you do, why do you want to have the realm different from the


We have multiple domains that we want to manage under one Kerberos realm. I
see that's it's possible for FreeIPA to manage multiple realms, but, for
simplicity, I'd rather use just one and have all domains underneath:

controls example1.com, example2.com, example3.com, etc.

Since we control all domain's DNS, we would create text records for each of
the example{x}.com domains pointing to REALM.COM Kerberos realm. We would
also create SRV records for each of the example{x}.com domains directing
Kerberos lookups to REALM.COM. I know it's a little unorthodox, but I'd
like to do it so we can keep everything in one easily managed lot.


P.S. I got several pornny spammy replies to this message. Is someone
sneaking into this list somehow?

Hello Steve,
in fact it's not possible to manage multiple Kerberos realms in one FreeIPA deployment. And judging from your description it also isn't what you want. On the other hand, having one realm and multiple DNS domains is standard situation and usually the name of the realm is derived from the primary domain (e.g. the one that matches organization name). If all your domains are equal just pick the one that you're most sure you'll keep under your control.

Regarding the spamming problem, we're all receiving it and the main problem is that the spam is not targeting freeipa-users@ list but the individual addresses in conversations. There's not much we can do but Simo is trying to find a solution.
David Kupka

Manage your subscription for the Freeipa-users mailing list:
Go to http://freeipa.org for more info on the project

Reply via email to