On ke, 18 joulu 2019, Matthias Vis wrote:
So, let's get straight:
- you have IPA deployment with Kerberos realm FOO.BAR, where initial
IPA master was installed on 'server 1'
Correct
- you enrolled 'server 5' to IPA deployment with Kerberos realm FOO.BAR
Correct
- now you want to create IPA deployment with Kerberos realm BAR.ZED
with initial IPA master on 'server 5' but you want 'server 5' to
belong to both FOO.BAR and BAR.ZED?
I want that the ipa-client on server 5 is still a member of FOO.BAR. For
the ipa-server on server 5, I don't need any client. I want only create
some users for some third party applications.
IPA masters replicate all data between
each other. If you'd add 'server
5' as a replica to existing FOO.BAR deployment, it will contain all
information that 'server 1' has. If you'd add users, they will be
available everywhere. It means that third-party applications connecting
to LDAP server on 'server 5' (when it would be a replica of IPA master
from 'server 1') will see all users/groups from your FOO.BAR deployment.
If this is what you want, just follow existing documentation on
promoting a client to replica. If not, then what I wrote stands: you
cannot have two separate deployments utilizing the same system.
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...
Hopeful this makes sense :-)
Groeten,
Matthias
On Wed, Dec 18, 2019 at 9:11 PM Alexander Bokovoy <abokovoy(a)redhat.com>
wrote:
> On ke, 18 joulu 2019, Matthias Vis via FreeIPA-users wrote:
> >Hi, I have a question about installing an ipa server. First of all I
> >have an ipa server installed on server 1 this one works correctly. I
> >also installed a client on server 5 and from now on I can connect
> >through this server via ssh and ssh-key provided in the ipa server. So
> >everything is fine until now. Now I want another ip-server for an
> >external party so they have there own ipa server, maintained by me and
> >want to install it on server 5. But when I install an ipa-server there
> >(for only bind-user purpose), I cannot ssh anymore to this machine. Is
> >there a workaround for it? So i can ssh to the server via the ipa on
> >server 1 and the ipa server on server 5 is only for bind-users?
>
> So, let's get straight:
> - you have IPA deployment with Kerberos realm FOO.BAR, where initial
> IPA master was installed on 'server 1'
> - you enrolled 'server 5' to IPA deployment with Kerberos realm FOO.BAR
> - now you want to create IPA deployment with Kerberos realm BAR.ZED
> with initial IPA master on 'server 5' but you want 'server 5' to
> belong to both FOO.BAR and BAR.ZED?
>
> Is this correct?
>
> This is not something that is possible or supported. Either 'server 5'
> belongs to FOO.BAR or it belongs to BAR.ZED, it cannot belong to both.
>
> For normal machines you might have a bit of "Servant of Two Master"
> (Goldoni, 1746) comedy but not for domain controllers. IPA master is a
> controller of its own domain, including Kerberos realm, so you either
> belong to one realm or to another, not both.
>
> --
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering
> Red Hat Limited, Finland
>
>
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland