Re: [Freeipa-users] IPA Ldap only as Client on different IPA server

2017-04-08 Thread Rob Crittenden
Matt . wrote: > The issue you get here is that the IPA client is not enrolled anymore > when you did an uninstall of the client before the IPA install on that > "previous" client which needs to be client again after the IPA install > on it. > > This sounds messy but could be ideal for some

Re: [Freeipa-users] IPA Ldap only as Client on different IPA server

2017-04-08 Thread Matt .
The issue you get here is that the IPA client is not enrolled anymore when you did an uninstall of the client before the IPA install on that "previous" client which needs to be client again after the IPA install on it. This sounds messy but could be ideal for some situations of useraccess on

Re: [Freeipa-users] IPA Ldap only as Client on different IPA server

2017-04-07 Thread Matt .
You are almost right, the box only needs to lookup users/groups from another IPA server for environment admins. The "LDAP Only" on this IPA server (and client) won't do anything on the whole network layer, only some webapp is talking to it and use users don't have anything todo with the network at

Re: [Freeipa-users] IPA Ldap only as Client on different IPA server

2017-04-07 Thread Rob Crittenden
Matt . wrote: > Nope, I provision my servers and they are added to my FreeIPA > environment which auths my systeadmins. But on a server I provisioned > I need to install FreeIPA as well, but without dns and ca, so it's > doing ldap only actually. > > When I want to install FreeIPA server on this

Re: [Freeipa-users] IPA Ldap only as Client on different IPA server

2017-04-07 Thread Matt .
Nope, I provision my servers and they are added to my FreeIPA environment which auths my systeadmins. But on a server I provisioned I need to install FreeIPA as well, but without dns and ca, so it's doing ldap only actually. When I want to install FreeIPA server on this IPA client it tells me

Re: [Freeipa-users] IPA Ldap only as Client on different IPA server

2017-04-07 Thread Rob Crittenden
Matt . wrote: > When I have a full ipa setup and I want to add a host to it that is > installed or needs to be installed as IPA LDAP server only, is that > possible ? If you're asking if only 389-ds can be configured on an IPA server, no, not using any IPA tools in any case. > Of course the