On 31.10.2015 00:38, Noriko Hosoi wrote:

https://fedorahosted.org/389/ticket/48328

https://fedorahosted.org/389/attachment/ticket/48328/0001-Ticket-48328-RFE-A...

This will break later with GSSAPI setup: Kerberos needs A name and if A name is different from the hostname, 389-ds may be confused as a server for GSSAPI-based LDAP binds. There might also be issues with GSSAPI-based replication agreements.

At the same time, GSSAPI use will break anyway with load balancing unless proper S4U2Proxy is set up for those cases (rarely so), so I would rather make it obviously documented than denying support for CNAME-based configurations.