On to, 19 joulu 2019, White, David via FreeIPA-users wrote:
> Are AD DCs using that DNS server to look up IPA zone records
already?
> Again, this is about AD DCs, not IPA itself.
AD (and the Corporate environment) talk to 1 set of DNS servers (let's call this
AD-DNS).
Our RedHat servers talk to a different set of DNS servers (let's call this RH-DNS).
IdM runs DNS internally for its own realm.
IdM forwards to RH-DNS for anything that it doesn't know about.
RH-DNS forwards to AD-DNS for anything that it doesn't know about.
AD-DNS does NOT query against RH-DNS or IdM.
To make sure I'm not crazy, I just logged into a Windows box on the AD environment and
did the following:
P:\>nslookup
idm.example.com
Server:
ad.example.com
Address: 10.1.1.2
***
ad.example.com can't find
idm.example.com: Non-existent domain
Yep, so you cannot do anything until your AD DCs will be able to query
DNS for IPA domain.
On 12/19/19, 10:31 AM, "Alexander Bokovoy" <abokovoy(a)redhat.com> wrote:
On to, 19 joulu 2019, White, David via FreeIPA-users wrote:
>Thank you for both of your responses.
>
>> No. The reason for that is that AD domain controllers have to resolve IPA DC
addresses as well and they use DNS for that too.
>I feel fairly certain that our AD environment is not currently able to
>resolve our production IPA servers. AD is not setup to do DNS
>resolution in our corporate environment, for one, and for another, I
>know that the IPA realm hasn't been added to our corporate DNS servers
>(as a slave zone, a forwarding zone, or otherwise).
>
>To clarify on our setup, IPA of course has its own realm.
>IPA is running its own DNS services.
>We have BIND running elsewhere that does DNS forwarding to the IPA
>realm.
Are AD DCs using that DNS server to look up IPA zone records already?
Again, this is about AD DCs, not IPA itself.
>
>> Just to add to that, you can't put SRV records in /etc/hosts, it merely
offers a means to resolve names to IPs and vice versa AFAIK.
>
>We have a stand-alone DNS server in our lab environment.
>Is it not possible to add the Active Directory SRV records in there?
Do you host the whole AD domain DNS zone on that DNS server?
Is that DNS server marked as authoritative to that zone?
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland