Thank you for both of your responses.
No. The reason for that is that AD domain controllers have to resolve
IPA DC addresses as well and they use DNS for that too.
I feel fairly certain that our AD environment is not currently able to resolve our
production IPA servers.
AD is not setup to do DNS resolution in our corporate environment, for one, and for
another, I know that the IPA realm hasn't been added to our corporate DNS servers (as
a slave zone, a forwarding zone, or otherwise).
To clarify on our setup, IPA of course has its own realm.
IPA is running its own DNS services.
We have BIND running elsewhere that does DNS forwarding to the IPA realm.
Just to add to that, you can't put SRV records in /etc/hosts, it
merely offers a means to resolve names to IPs and vice versa AFAIK.
We have a stand-alone DNS server in our lab environment.
Is it not possible to add the Active Directory SRV records in there?
From: Angus Clarke <post(a)angusclarke.com>
Date: Thursday, December 19, 2019 at 7:22 AM
Cc: "White, David" <whitedm(a)epb.net>, Alexander Bokovoy
<abokovoy(a)redhat.com>
Subject: [Freeipa-users] Re: Setup AD Trust without DNS resolution from AD
Just to add to that, you can't put SRV records in /etc/hosts, it merely offers a means
to resolve names to IPs and vice versa AFAIK.
Regards
Angus
From: Alexander Bokovoy via FreeIPA-users <freeipa-users(a)lists.fedorahosted.org>
Sent: Wednesday, 18 December 2019, 19:47
To: FreeIPA users list
Cc: White, David; Alexander Bokovoy
Subject: [Freeipa-users] Re: Setup AD Trust without DNS resolution from AD
On ke, 18 joulu 2019, White, David via FreeIPA-users wrote:
I am trying to spin up a new 2-node cluster in my lab environment.
I have FreeIPA installed, and can login to the web UI.
At this point, I’m trying to establish a trust with AD:
ipa trust-add --type=ad
example.net --admin administrator
Based on the errors I was getting with that command’s stdout and
subsequent research, it occurred to me that I don’t have DNS resolution
to our corporate internal DNS from my lab environment.
As this is a lab environment, I really don’t care about best practices
(although I do eventually want to get corporate DNS resolution into my
lab, that’s likely not happening until January given the holidays… and
I need to make progress on this project if at all possible).
Is it possible to set the required AD records into `/etc/hosts` on each
of the (2) nodes?
No. The reason for that is that AD domain controllers have to resolve
IPA DC addresses as well and they use DNS for that too. So it is not
just on IPA side. Additionally, after they resolved SRV records via DNS,
they perform actual site-local search using connectionless LDAP (CLDAP,
389/UDP) directly at the DCs and then resolve those DCs via DNS, so
there is need to have a fully working DNS setup.
And/or since I already have IdM installed with DNS services, is it
possible for me to go into the web UI, and create a new DNS zone in
there for the upstream AD environment?
Here are the records I’ve entered into my /etc/hosts file on the master
FreeIPA server that I’m trying to use to establish the trust (As you
can see, we have 4 AD servers, so I have set the “A” record in
/etc/hosts four different times):
Idm-node-1.fiberlab.example.net
Idm-node-2.fiberlab.example.net
example.net
example.net
example.net
example.net
_kerberos._tcp.example.net
_kerberos._tcp.example.net
_kerberos._tcp.example.net
_kerberos._tcp.example.net
_kerberos._udp.example.net
_kerberos._udp.example.net
_kerberos._udp.example.net
_kerberos._udp.example.net
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdocs.fe...
List Guidelines:
https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedorap...
List Archives:
https://nam01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.f...