On 31.10.2015 00:38, Noriko Hosoi wrote:
This will break later with GSSAPI setup: Kerberos needs A name and if A
name is different from the hostname, 389-ds may be confused as a server
for GSSAPI-based LDAP binds. There might also be issues with
GSSAPI-based replication agreements.
At the same time, GSSAPI use will break anyway with load balancing
unless proper S4U2Proxy is set up for those cases (rarely so), so I
would rather make it obviously documented than denying support for
CNAME-based configurations.
--
/ Alexander Bokovoy