On ke, 24 loka 2018, Chris Dagdigian via FreeIPA-users wrote:
Is it possible to override the AD integration use of DNS queries to
find AD controllers and replace the auto-discovery with a named list
of domain controllers?
Where? In 'ipa trust-add' or in SSSD? The former has
already a mechanism
by specifying a domain controller to contact.
We've got a setup in an AWS VPC and we've found that out of
the 100 or
so domain controllers in DNS that a few of them refuse to talk to us
or answer ldaps:// queries. After a lot of nmap and DNS probe work we
think we've discovered a number of "bad" controllers that may be
responsible for random password check / login failures in the AWS
environment
Can the latest sssd/free-ipa be configured to use a list of "known
good" domain controllers?
SSSD can be pinned down to the specific site and also
to specific domain
controllers in 1.16+. Some of the configurations are possible with
earlier versions too, see manual page for sssd-ipa(5), section "Trusted
domains configuration".
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland