[Freeipa-users] Is IPA secure enough for public exposure plus trust management issue

Hello,

I am looking for a way of allowing users to reset their password without going through the VPN. I usually send users notification when the password are about to expire, but they don't follow up until something stop working. At that point, they can't even VPN.

Have anyone else exposed IPA to the public and have it faired well?

Also, is there a way of changing one way trust (The default) to two way trust without first removing the current trust?

Regards, William