Hello Rob,

Thanks you for your feedback.
Im a beginner on IPA. The final design is not stopped yet.

The first idea was to have the same REALM in the same ipa-client for easy management, because the networks dont communicate.
If the first IPA server going down (or the sit will be unreachable), the second IPA server can be access.
Your answer convinces me now.

What is the best design ?
Create 1 REALM with the Location configuration (with other ipa server, to manage the subdomain ) ?

Or to create 2 REAML ?

Does that mean I'm going to modify the sssd.conf + krb5.conf files?
Regard

Bien à vous

Mr Karim Bourenane
+33686464439
+32493866354
 


Le mar. 23 avr. 2019 à 16:25, Rob Crittenden <rcritten@redhat.com> a écrit :
Karim Bourenane via FreeIPA-users wrote:
> Hello All,
>
> I need your help. I have a small projet, finale design no fixed yet :
> 2 IPA server in dedicat network (no link between), but with the same
> REALM: IPA.EXAMPLE.COM <http://IPA.EXAMPLE.COM>
>
> I want to deploy some IPA-client with 2 interfaces, each host interface
> managed by each IPA server. 
>
> Can you confirm me, that its possible to enroll 2 time the ipa-client in
> each servers ?
>
> If yes, i need to configure well the SSSD + KRB5 (kerberos). Can you
> help me about this configuration ?

Two separate but identically named realms? Not possible.

Two differently named realms at once, not possible without manual
intervention. You could use ipa-client-install to set up one and then
you'd have to manually update files to add the other. You'd have
difficulty using the ipa command-line tool and certmonger, being limited
to a single realm.

I'd be curious about the reason for doing this.

rob