Thanks! Replies in line

Alexander Bokovoy wrote on 10/24/18 8:40 AM:

On ke, 24 loka 2018, Chris Dagdigian via FreeIPA-users wrote:

Is it possible to override the AD integration use of DNS queries to find AD controllers and replace the auto-discovery with a named list of domain controllers?
Where? In 'ipa trust-add' or in SSSD? The former has already a mechanism
by specifying a domain controller to contact.

Trust is already built and that took *months* to arrange with the mysterious AD admins who do not talk to mere mortals. Not going to mess with that! Looking to pin IDM interactions with named AD servers at the sssd.conf level I think

We've got a setup in an AWS VPC and we've found that out of the 100 or so domain controllers in DNS that a few of them refuse to talk to us or answer ldaps:// queries. After a lot of nmap and DNS probe work we think we've discovered a number of "bad" controllers that may be responsible for random password check / login failures in the AWS environment

Can the latest sssd/free-ipa be configured to use a list of "known good" domain controllers?
SSSD can be pinned down to the specific site and also to specific domain
controllers in 1.16+. Some of the configurations are possible with
earlier versions too, see manual page for sssd-ipa(5), section "Trusted
domains configuration".

Thank you ! We will research/test this

Love this list and the resources on it!

Regards,
Chris