On Tue, 2011-05-24 at 15:02 +0200, Jan Zelený wrote:
Yes, both paths should work, I was just wondering if (and how) it is
possible
to evaluate which one is better (for example better connectivity). But
this
applies only in case SSSD will ask the primary domain server which
will then
ask the trusted domain and so on. As I wrote before, if SSSD asks
directly the
trusted KDC, my question is pointless and can be ignored.
At the moment we do not support to be "joined" to multiple realms at the
same time so I think the question is moot. I also think that this
scenario is quite unlikely.
However the first domain configured in sssd.conf would probably always
be the one to handle the "shared" subdomain, regardless of other
considerations.
Simo.
--
Simo Sorce * Red Hat, Inc * New York