If I have a server that is in a subdomain of my tld for FreeIPA and I want it to get added into that specific zone during the client install process, the installer errors out and says that it will only recognize 1 FreeIPA server and failover to the other will not be possible. Is there some way around this? Something I can change in the /etc/sssd/sssd.conf ? Domain is example.com my new server is server123.mgt.datacenter.example.com I have the zones created but I don't see the kerberos records in there. Thank you!
Andrew Meyer via FreeIPA-users wrote:
If I have a server that is in a subdomain of my tld for FreeIPA and I want it to get added into that specific zone during the client install process, the installer errors out and says that it will only recognize 1 FreeIPA server and failover to the other will not be possible. Is there some way around this? Something I can change in the /etc/sssd/sssd.conf ?
Domain is example.com
my new server is server123.mgt.datacenter.example.com
I have the zones created but I don't see the kerberos records in there.
I'm not entirely sure I follow, posting the exact message(s) you're seeing would help, but what I think you did was:
# ipa-client-install --server=foo.example.test
And you got a notice about failover
If so I'd check out the DNS Autodiscovery in the ipa-client-install man page.
Failover also uses DNS discovery so if it won't work during install it likely won't work post-install either.
rob
i'm going to be adding a new machine next week. I'll get screenshots/text output for you.
On Friday, November 3, 2017 1:54 PM, Rob Crittenden via FreeIPA-users freeipa-users@lists.fedorahosted.org wrote:
Andrew Meyer via FreeIPA-users wrote:
If I have a server that is in a subdomain of my tld for FreeIPA and I want it to get added into that specific zone during the client install process, the installer errors out and says that it will only recognize 1 FreeIPA server and failover to the other will not be possible. Is there some way around this? Something I can change in the /etc/sssd/sssd.conf ?
Domain is example.com
my new server is server123.mgt.datacenter.example.com
I have the zones created but I don't see the kerberos records in there.
I'm not entirely sure I follow, posting the exact message(s) you're seeing would help, but what I think you did was:
# ipa-client-install --server=foo.example.test
And you got a notice about failover
If so I'd check out the DNS Autodiscovery in the ipa-client-install man page.
Failover also uses DNS discovery so if it won't work during install it likely won't work post-install either.
rob _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
If I understand your question, you want to specify —domain=example.comhttp://example.com in ipa-client-install. /etc/sssd/sssd.conf
After installation you can fix it. Make sure
the DNS entry for example.comhttp://example.com has all the SRV records
/etc/sssd/sssd.conf ipa_domain is set dns_discovery_domain is set if needed no explicit ipa server name is set
/etc/krb5.conf in the realm section, default_domain is set no explicit hostnames are given except admin_server. You can list all of them on separate lines.
On Nov 3, 2017, at 11:31:18 AM, Andrew Meyer via FreeIPA-users <freeipa-users@lists.fedorahosted.orgmailto:freeipa-users@lists.fedorahosted.org> wrote:
If I have a server that is in a subdomain of my tld for FreeIPA and I want it to get added into that specific zone during the client install process, the installer errors out and says that it will only recognize 1 FreeIPA server and failover to the other will not be possible. Is there some way around this? Something I can change in the /etc/sssd/sssd.conf ?
Domain is example.comhttp://example.com
my new server is server123.mgt.datacenter.example.comhttp://server123.mgt.datacenter.example.com
I have the zones created but I don't see the kerberos records in there.
Thank you! _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.orgmailto:freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.orgmailto:freeipa-users-leave@lists.fedorahosted.org
freeipa-users@lists.fedorahosted.org
-
Andrew Meyer -
Charles Hedrick -
Rob Crittenden