[SSSD] connecting sssd to two IPA servers

Jakub Hrozek jhrozek at redhat.com
Thu Jan 19 11:27:38 UTC 2012


On Thu, Jan 19, 2012 at 11:42:25AM +0100, David Juran wrote:
> Hello
> 
> I have a case where a customer would like to authenticate users from two
> different AD domains. Since IPA (currently) can't sync with multiple AD
> domains, I was thinking of setting up two independent IPA servers that
> sync with one AD each and then configure the clients with multiple sssd
> authentication domains to authenticate users from both IPA:s.
> 
> Would this work? Does anyone foresee any difficulties?
> 

>From SSSD point of view it would, it's just two different domains.

You'd have to be careful about referencing the users by name, though,
and use a fully qualified name (user at domain) to specify the particular
users. Otherwise, all the searches would iterate over domains until they
find a hit, which may be slow (SSSD ticket #843) and not return the desired
result if there are users with the same name in both domains.

I'm not aware of problems with duplicating to AD servers to two IPA
servers, but this question would be better answered on the freeipa-users
mailing list (freeipa-users at redhat.com)



More information about the sssd-devel mailing list