<html dir="ltr"> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css" id="owaParaStyle"></style> </head> <body fpstyle="1" ocsi="0"> <div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">The "problem" i'm trying to solve is more of a design choice i guess. I would like to introduce RH Identity Management (IPA) since we need to handle authentication for *NIX machines. <div>I guess i could integrate them towards Active Directory but i would rather enjoy all the benefits of running RH-IPA (HBAC/Sudo rules, and further down SELINUX integration) and able to use my current RH support contracts.<br> <div><br> </div> <div>The current infrastructure looks the following.</div> <div>Internal dns/KERBEROS domain handled by Microsoft active directory: company.internal@COMPANY.INTERNAL</div> <div>A second domain consisting of company.tld (this is a correct top level domain) but this domain exists both internal and external.</div> <div><br> </div> <div>So internall machines that CANT be reached from the outside world has either company.tld or company.internal hostnames. (all of the *nix machines has the domain company.tld allthough they are almost all internal machines)</div> <div>Kerberos authentication is working now for machines on the inside in both dns domains. This is handled by Active directory.</div> <div>I even have some *nix machines using AD kerberos realm for SSO of apache webservers, theese are all internal company.tld machines.</div> <div><br> </div> <div>So the question is how i would design the DNS structure to allow IPA and AD coexistance.</div> </div> <div>I would like to avoid having to move all my current *nix machines out of company.tld (allthough this would be the most correct solution)</div> <div>Maybe i could have dual hostnames for all my *nix machines but the question is how much administrative overhead this would give. And i would like to "Keep It Simple"</div> <div><br> </div> <div>I understand that this might not be a <font face="Segoe UI, Helvetica, Arial, sans-serif"> question for this mailing list ;)</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif">I hope it doesnt rub anyone the wrong way.</font></div> <div><font face="Segoe UI, Helvetica, Arial, sans-serif"><br> </font></div> <div><br> </div> </div> </body> </html>