On ke, 18 joulu 2019, Matthias Vis via FreeIPA-users wrote:
>Hi, I have a question about installing an ipa server. First of all I
>have an ipa server installed on server 1 this one works correctly. I
>also installed a client on server 5 and from now on I can connect
>through this server via ssh and ssh-key provided in the ipa server. So
>everything is fine until now. Now I want another ip-server for an
>external party so they have there own ipa server, maintained by me and
>want to install it on server 5. But when I install an ipa-server there
>(for only bind-user purpose), I cannot ssh anymore to this machine. Is
>there a workaround for it? So i can ssh to the server via the ipa on
>server 1 and the ipa server on server 5 is only for bind-users?
So, let's get straight:
- you have IPA deployment with Kerberos realm FOO.BAR, where initial
IPA master was installed on 'server 1'
- you enrolled 'server 5' to IPA deployment with Kerberos realm FOO.BAR
- now you want to create IPA deployment with Kerberos realm BAR.ZED
with initial IPA master on 'server 5' but you want 'server 5' to
belong to both FOO.BAR and BAR.ZED?
Is this correct?
This is not something that is possible or supported. Either 'server 5'
belongs to FOO.BAR or it belongs to BAR.ZED, it cannot belong to both.
For normal machines you might have a bit of "Servant of Two Master"
(Goldoni, 1746) comedy but not for domain controllers. IPA master is a
controller of its own domain, including Kerberos realm, so you either
belong to one realm or to another, not both.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland