So, let's get straight:
 - you have IPA deployment with Kerberos realm FOO.BAR, where initial
   IPA master was installed on 'server 1'

Correct

 - you enrolled 'server 5' to IPA deployment with Kerberos realm FOO.BAR

Correct

 - now you want to create IPA deployment with Kerberos realm BAR.ZED
   with initial IPA master on 'server 5' but you want 'server 5' to
   belong to both FOO.BAR and BAR.ZED?  

I want that the ipa-client on server 5 is still a member of  FOO.BAR. For the ipa-server on server 5, I don't need any client. I want only create some users for some third party applications.

Hopeful this makes sense :-)

Groeten,

Matthias


On Wed, Dec 18, 2019 at 9:11 PM Alexander Bokovoy <abokovoy@redhat.com> wrote:
On ke, 18 joulu 2019, Matthias Vis via FreeIPA-users wrote:
>Hi, I have a question about installing an ipa server. First of all I
>have an ipa server installed on server 1 this one works correctly. I
>also installed a client on server 5 and from now on I can connect
>through this server via ssh and ssh-key provided in the ipa server. So
>everything is fine until now. Now I want another ip-server for an
>external party so they have there own ipa server, maintained by me and
>want to install it on server 5. But when I install an ipa-server there
>(for only bind-user purpose), I cannot ssh anymore to this machine. Is
>there a workaround for it? So i can ssh to the server via the ipa on
>server 1 and the ipa server on server 5 is only for bind-users?

So, let's get straight:
 - you have IPA deployment with Kerberos realm FOO.BAR, where initial
   IPA master was installed on 'server 1'
 - you enrolled 'server 5' to IPA deployment with Kerberos realm FOO.BAR
 - now you want to create IPA deployment with Kerberos realm BAR.ZED
   with initial IPA master on 'server 5' but you want 'server 5' to
   belong to both FOO.BAR and BAR.ZED?

Is this correct?

This is not something that is possible or supported. Either 'server 5'
belongs to FOO.BAR or it belongs to BAR.ZED, it cannot belong to both.

For normal machines you might have a bit of "Servant of Two Master"
(Goldoni, 1746) comedy but not for domain controllers. IPA master is a
controller of its own domain, including Kerberos realm, so you either
belong to one realm or to another, not both.

--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland