Hi,
On Thu, Oct 13, 2022 at 11:04 AM iulian roman via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
Hello everybody,
I have a FreeIPA setup with AD trust which works properly. I recently
noticed that authentication does not work on some freeipa clients which are
in a firewalled network. All ports to the FreeIPA servers were allowed in
the firewall. Checking the logs , I observed that kerberos client on
freeipa clients does try to connect directly to Active Directory Domain
Controllers , not only to the KDC in FreeIPA server.
Can anyone please explain or point to the documentation where it is
mentioned exactly why do we still need direct connectivity to AD on port 88
for FreeIPA clients ?
You can refer to this chapter: Ports required for communication between
IdM and AD
[1] and: Troubleshooting client access to services in the other
forest [2] which has nice diagrams with the information flow.
HTH,
flo
[1]
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...
[2]
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...
Regards,
iulian
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue