On ke, 24 loka 2018, Chris Dagdigian via FreeIPA-users wrote:
Is it possible to override the AD integration use of DNS queries to find AD controllers and replace the auto-discovery with a named list of domain controllers?
Where? In 'ipa trust-add' or in SSSD? The former has already a mechanism by specifying a domain controller to contact.
We've got a setup in an AWS VPC and we've found that out of the 100 or so domain controllers in DNS that a few of them refuse to talk to us or answer ldaps:// queries. After a lot of nmap and DNS probe work we think we've discovered a number of "bad" controllers that may be responsible for random password check / login failures in the AWS environment
Can the latest sssd/free-ipa be configured to use a list of "known good" domain controllers?
SSSD can be pinned down to the specific site and also to specific domain controllers in 1.16+. Some of the configurations are possible with earlier versions too, see manual page for sssd-ipa(5), section "Trusted domains configuration".