On pe, 30 huhti 2021, iulian roman via FreeIPA-users wrote:
> On to, 29 huhti 2021, iulian roman via FreeIPA-users wrote:
>
> First, to make it clear. You should not have IPA servers (replicas) in
> .example.local. If you'd do, this is unsupported configuration and any
> bugs you'd see there are your own problems. There is simply no way to
> support servers from two separate Kerberos realms trusting each other in
> the same DNS domain.
That means that both ipa server and replica should be in the
.ipadev.example.local DNS domain (or any other domain different than
.example.local) ?
Correct -- in any DNS domain owned by your IPA deployment.
It is unfortunate that there is a confusion between AD domain and DNS
domain terminology-wise. AD domain may "own" several DNS domains, as
described in the AD domain topology, but it is not required to host DNS
services for those, in general. For the purpose of trust to Active
Directory, IPA deployment represents a separate AD forest with at least
one DNS domain owned by the forest root of IPA (=ipadev.example.local in
your case). It may include many others but those DNS domains must not be
overlapped with the DNS domains owned by a different AD forest,
especially a trusted one.
Who serves DNS domains over DNS protocol is irrelevant here.
Please see [MS-ADOD] for more details and requirements.
I need to mention that I am not using any integrated DNS, but an
external one configured in Infoblox. The trust is only one way (ipa
trusts AD domain).
[MS-ADOD]
https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adod/c3b2...
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland