<div dir="ltr">Ticket created : Ticket #3955<div><br></div><div><br></div></div><div class="gmail_extra"><br clear="all"><div><br><div>--</div><div><a href="http://about.me/chandank" target="_blank">http://about.me/chandank</a><br>
</div></div>
<br><br><div class="gmail_quote">On Fri, Sep 27, 2013 at 12:40 AM, Petr Spacek <span dir="ltr"><<a href="mailto:pspacek@redhat.com" target="_blank">pspacek@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On 27.9.2013 07:23, Chandan Kumar wrote:<br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
Hi Rob,<br>
<br>
Thanks for the info. Sure I will create the ticket and will certainly try<br>
to pick the low-hanging fruit :-)<br>
<br>
<br>
--<br>
<a href="http://about.me/chandank" target="_blank">http://about.me/chandank</a><br>
<br>
<br>
On Thu, Sep 26, 2013 at 7:51 PM, Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>> wrote:<br>
<br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Chandan Kumar wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">
Hello,<br>
<br>
I have basic configuration question, my apologies if it has already been<br>
discussed.<br>
<br>
I have ipa-server-3 server installed with default parameters with<br>
replication.<br>
<br>
We have Linux machines across different geo location and I would like to<br>
integrate them into IPA server, however, I don't want external clients<br>
to connect the server on standard port.<br>
<br>
For example, during ipa-client registration it requires all IPA services<br>
to be running on default port.<br>
<br>
Such as : trying <a href="https://ipa01.my.net/ipa/xml" target="_blank">https://ipa01.my.net/ipa/xml</a><br>
<br>
kdc = <a href="http://ipa01.my.net:88" target="_blank">ipa01.my.net:88</a> <<a href="http://ipa01.my.net:88" target="_blank">http://ipa01.my.net:88</a>><br>
master_kdc = <a href="http://ipa01.my.net:88" target="_blank">ipa01.my.net:88</a> <<a href="http://ipa01.my.net:88" target="_blank">http://ipa01.my.net:88</a>><br>
admin_server = <a href="http://ipa01.my.net:749" target="_blank">ipa01.my.net:749</a> <<a href="http://ipa01.my.net:749" target="_blank">http://ipa01.my.net:749</a>><br>
<br>
<br>
Is there any way in ipa-client-install or sssd file to instruct IPA<br>
client to connect to IPA server on no-standard ports such as<br>
<br></div>
trying <a href="https://ipa01.my.net:8080/ipa/**xml" target="_blank">https://ipa01.my.net:8080/ipa/<u></u>**xml</a><<a href="https://ipa01.my.net:8080/ipa/xml" target="_blank">https://ipa01.my.net:<u></u>8080/ipa/xml</a>><div class="im">
<br>
<br>
This way I don't have to allocate a separate IP or additional web server<br>
to redirect the requests a simple NAT at firewall will do such as<br>
external 8080 -> internal 443<br>
<br>
</div></blockquote><div class="im">
<br>
Currently there is no way to do this. I'd have sworn we had a ticket to<br>
add this but a quick search didn't turn it up. If you'd like this supported<br></div>
feel free to open a ticket at <a href="https://fedorahosted.org/**freeipa/newticket" target="_blank">https://fedorahosted.org/**<u></u>freeipa/newticket</a><<a href="https://fedorahosted.org/freeipa/newticket" target="_blank">https://<u></u>fedorahosted.org/freeipa/<u></u>newticket</a>><div class="im">
<br>
<br>
I don't think this would be tremendously difficult to do, the trick would<br>
be communicating the port to clients somehow while they are trying to<br>
enroll. A command-line option would probably be the shortest path.<br>
<br>
This may be decent low-hanging fruit if you're interested in being a<br>
contributor to IPA.<br>
</div></blockquote></blockquote>
<br>
Speaking specifically about Kerberos, LDAP and NTP - it should be possible to change port number in SRV records in DNS and that is it. I'm not sure if client libraries really support this, but you can try it.<br>
<br>
HTTP and HTTPS will be more problematic because there there are no SRV records for them.<span class="HOEnZb"><font color="#888888"><br>
<br>
-- <br>
Petr^2 Spacek<br>
<br>
______________________________<u></u>_________________<br>
Freeipa-users mailing list<br>
<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/<u></u>mailman/listinfo/freeipa-users</a><br>
</font></span></blockquote></div><br></div>