On Wed, Oct 24, 2018 at 08:53:10AM -0400, Chris Dagdigian via FreeIPA-users wrote:
Thanks! Replies in line
Alexander Bokovoy wrote on 10/24/18 8:40 AM:
> On ke, 24 loka 2018, Chris Dagdigian via FreeIPA-users wrote:
> > Is it possible to override the AD integration use of DNS queries to
> > find AD controllers and replace the auto-discovery with a named list
> > of domain controllers?
> Where? In 'ipa trust-add' or in SSSD? The former has already a mechanism
> by specifying a domain controller to contact.
Trust is already built and that took *months* to arrange with the mysterious
AD admins who do not talk to mere mortals. Not going to mess with that!
Looking to pin IDM interactions with named AD servers at the sssd.conf level
> > We've got a setup in an AWS VPC and we've found that out of the 100
> > or so domain controllers in DNS that a few of them refuse to talk to
> > us or answer ldaps:// queries. After a lot of nmap and DNS probe
> > work we think we've discovered a number of "bad" controllers
> > may be responsible for random password check / login failures in the
> > AWS environment
> > Can the latest sssd/free-ipa be configured to use a list of "known
> > good" domain controllers?
> SSSD can be pinned down to the specific site and also to specific domain
> controllers in 1.16+. Some of the configurations are possible with
> earlier versions too, see manual page for sssd-ipa(5), section "Trusted
> domains configuration".
Thank you ! We will research/test this
Love this list and the resources on it!
A small correction to Alexander's mail:
On IPA masters themselves, setting something like:
ad_server = foo, bar, baz
or even just:
ad_site = my.site
was working since 1.15:
but clients were a different matter and the above configurations would
only work since versions that implement:
upstream-wise this is since 1.16.3, but the patches were also backported
to RHEL-7.6 (which should be released in short future)
If you have an older client, you can work around this issue by setting
the AD DCs in krb5.conf (yes, krb5.conf, not sssd.conf) directly.