I have setup an Idm environment with replica and AD trust. I have the following realms and
domains:
IPADEV.EXAMPLE.LOCAL is the IPA realm with the domain ipadev.example.local
EXAMPLE.LOCAL is the AD realm with dns domain example.local
All the clients have the DNS domain example.local and are/will be enrolled to the IPA
domain.
In the IPA servers I had the following entries (added by the installation process) in
/etc/krb5.conf :
server
=====
[domain_realm]
.ipadev.example.local = IPADEV.EXAMPLE.LOCAL
ipadev.example.local = IPADEV.EXAMPLE.LOCAL
ipadev04.example.local = IPADEV.EXAMPLE.LOCAL
.example.local = IPADEV.EXAMPLE.LOCAL
example.local = IPADEV.EXAMPLE.LOCAL
.example.local = IPADEV.EXAMPLE.LOCAL
example.local = IPADEV.EXAMPLE.LOCAL
client
====
[domain_realm]
.ipadev.example.local = IPADEV.EXAMPLE.LOCAL
ipadev.example.local = IPADEV.EXAMPLE.LOCAL
ipadev02.example.local = IPADEV.EXAMPLE.LOCAL
.example.local = IPADEV.EXAMPLE.LOCAL
example.local = IPADEV.EXAMPLE.LOCAL
Because of various issues (either replication did not work, either clients could not query
AD), I had removed entries on the server config (at some point i had .example.local =
EXAMPLE.LOCAL but that broke the replication between ipa servers ) and now it looks like
that:
[domain_realm]
.ipadev.example.local = IPADEV.EXAMPLE.LOCAL
ipadev.example.local = IPADEV.EXAMPLE.LOCAL
ipadev04.example.local = IPADEV.EXAMPLE.LOCAL
My question is , how should the [domain_realm] section of the /etc/krb5.conf look like on
both ipa server and ipa client ?
Is dns_lookup_realm = true and dns_lookup_kdc = true enough in the [libdefaults] section
or should these realm be explicitly added ? What are the tradeoffs of not using them ?
Show replies by date