On to, 19 joulu 2019, White, David via FreeIPA-users wrote:
Thank you for both of your responses.
> No. The reason for that is that AD domain controllers have to resolve IPA DC
addresses as well and they use DNS for that too.
I feel fairly certain that our AD environment is not currently able to
resolve our production IPA servers. AD is not setup to do DNS
resolution in our corporate environment, for one, and for another, I
know that the IPA realm hasn't been added to our corporate DNS servers
(as a slave zone, a forwarding zone, or otherwise).
To clarify on our setup, IPA of course has its own realm.
IPA is running its own DNS services.
We have BIND running elsewhere that does DNS forwarding to the IPA
realm.
Are AD DCs using that DNS server to look up IPA zone records already?
Again, this is about AD DCs, not IPA itself.
> Just to add to that, you can't put SRV records in /etc/hosts, it merely offers a
means to resolve names to IPs and vice versa AFAIK.
We have a stand-alone DNS server in our lab environment.
Is it not possible to add the Active Directory SRV records in there?
Do you host the
whole AD domain DNS zone on that DNS server?
Is that DNS server marked as authoritative to that zone?
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland