Hi, I've been reading through the mail archives, and doing the obligatory google search, but seem to be hitting a brick wall on trying to get a better understanding of something that should be trivial to get a handle on (I think).
MIT Kerberos 1.7 configured with a KLDAP backend to a multi-master resilient LDAP service; single realm. I understand that we can run multiple KDCs in an autonomous way, but sharing the same data store (in LDAP), this is good, and what I want to have - i.e. a resilient KDC service. We can misplace a data centre, but still offer a KDC service as LDAP has made sure that the data is replicated around the globe. There are references to individual/groups who have done this, and all looks well. However what are the pitfalls with this approach? Specifiaclly: - Is any local state held by the krb5kdc process that would cause issues down the line? - Ar there any issues with running multiple master (same backing store - LDAP) for the same realm? In a similar vein can kadmind be made resilient in the same manner (all documents I've seen so far are catagorical that only one kadmind service should be running). Many Thanks. -- Rhod ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
