Thank you for reply Alexander, sorry so long to reply.
As a test we added the trust-agent to the msdcs srv records within FreeIPA DNS and stopped
ipa services on the trust-controller.
The same behaviour was exhibited; "Cannot contact any KDC for realm
'FREEIPADOMAIN.COM'" when attempting auth as AD user on freeipa joined
clients.
The client's have the KDC's hardcoded in the krb5.conf for both the freeipa and AD
realms. This was required due to our environment/use case and has been running fine for 2+
years. This issue was only realized recently when the trust-controller was offline.
So the krb5.conf realms section looks like this on all clients.
[realms]
FREEIPADOMAIN.COM = {
kdc = freeipa-idm-0.freeipadomain.com:88 #Trust-Controller
kdc = freeipa-idm-1.freeipadomain.com:88 #Trust-Agent
master_kdc = freeipa-idm-1.freeipadomain.com:88 #Trust-Agent
admin_server = freeipa-idm-1.freeipadomain.com:749 #Trust-Agent
default_domain =
freeipadomain.com
pkinit_anchors = FILE:/etc/ipa/ca.crt
}
AD-DOMAIN.COM = {
kdc =
dc1.ad-domain.com
admin_server =
dc1.ad-domain.com
}
As a quick test, we watched the DNS cache on the AD DC for the
FREEIPADOMAIN.COM
conditional forwarder that points to the FreeIPA Idm servers; while authenticating to
several client boxes with AD accounts. The msdcs svr records never appeared in cache; so
lookups were not being directed to the AD DC for this. Doing an interactive lookup with
Dig/Nslookup for msdcs svr records, with focus on the AD DC, the records for both FreeIPA
Idm servers were returned successfully as expected. Since we are hard coding the KDC's
and all are resolvable from both FreeIPA DNS & AD DNS, it feels like there is some
lack of functionality/configuration perhaps on the Trust-Agent we are missing to make this
work.
Thanks
-Dave