<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 12/08/2014 10:07 AM, Matthew Herzog
wrote:<br>
</div>
<blockquote
cite="mid:CABhyZ36a7RCg2SzXeM9xzhVTtJto_T8eJcpAFAZ2p_PHVSo2ig@mail.gmail.com"
type="cite">
<div dir="ltr">My Linux/LDAP domain is <a moz-do-not-send="true"
href="http://lnx.e-bozo.com">lnx.e-bozo.com</a>. The AD domain
is <a moz-do-not-send="true" href="http://ad.e-bozo.com">ad.e-bozo.com</a>.
This has always been the case. I set up my FreeIPA server in the
<a moz-do-not-send="true" href="http://lnx.e-bozo.com">lnx.e-bozo.com</a>
domain using realm <a moz-do-not-send="true"
href="http://LNX.E-BOZO.COM">LNX.E-BOZO.COM</a>. In light of
this, how should I proceed?</div>
</blockquote>
<br>
If you prefer to continue using your DNS servers then you need to
add all DNS records that FreeIPA defined for you at the end of the
installation, manually to your DNS.<br>
As soon as you did this you should be able to establish the trust.<br>
<br>
You would need to update your DNS server with any new replicas you
add. <br>
<br>
<blockquote
cite="mid:CABhyZ36a7RCg2SzXeM9xzhVTtJto_T8eJcpAFAZ2p_PHVSo2ig@mail.gmail.com"
type="cite">
<div class="gmail_extra"><br>
<div class="gmail_quote">On Mon, Dec 8, 2014 at 9:48 AM, Simo
Sorce <span dir="ltr"><<a moz-do-not-send="true"
href="mailto:simo@redhat.com" target="_blank">simo@redhat.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex"><span
class="">On Mon, 08 Dec 2014 08:58:46 -0500<br>
Dmitri Pal <<a moz-do-not-send="true"
href="mailto:dpal@redhat.com">dpal@redhat.com</a>>
wrote:<br>
<br>
> > Perhaps I should have explained that we are not
going to set up a<br>
> > new DNS domain for the ipa-managed servers.<br>
<br>
</span>Note that if you cannot set up a new DNS domain and
this domain is the<br>
same as the AD domain then you cannot to the stuff Dmitri
describe<br>
below. The only way to have accounts on freeipa in this case
is to use<br>
the winsync method, which has a number of limitation.<br>
Also clients will be rather confused when you try to<br>
ipa-client-install as they will find AD servers instead of
ipa servers,<br>
finally you'll have to use a different realm name for the
IPA domain,<br>
one that doesn't match the AD domain.<br>
<br>
HTH,<br>
Simo.<br>
<span class="im HOEnZb"><br>
> > We have an Oracle dsee7<br>
> > server doing LDAP for our Linux servers and
accounts. We want to<br>
> > migrate to IPA so we don't have to maintain a
Linux/LDAP account<br>
> > for every user who needs access to Linux
servers. All of our users<br>
> > start with an account in AD and since none of my
predecessors knew<br>
> > about Winbind, they set up dsee7.<br>
> ><br>
> > So I'm thinking we'll need to import all our
dsee7 accounts AND<br>
> > make it possible for AD users to access the
Linux systems without<br>
> > needing to create them in IPA.<br>
><br>
><br>
> So the approach would be:<br>
><br>
> 1) Install IPA (do not migrate users)<br>
> 2) Establish trust with AD<br>
> 3) Start switching client configuration from using
LDAP with dsee7 to<br>
> SSSD pointing to IPA<br>
><br>
> You do not need to migrate users.<br>
<br>
<br>
<br>
</span><span class="HOEnZb"><font color="#888888">--<br>
Simo Sorce * Red Hat, Inc * New York<br>
</font></span>
<div class="HOEnZb">
<div class="h5"><br>
--<br>
Manage your subscription for the Freeipa-users mailing
list:<br>
<a moz-do-not-send="true"
href="https://www.redhat.com/mailman/listinfo/freeipa-users"
target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
Go To <a moz-do-not-send="true"
href="http://freeipa.org" target="_blank">http://freeipa.org</a>
for more info on the project<br>
</div>
</div>
</blockquote>
</div>
<br>
<br clear="all">
<div><br>
</div>
-- <br>
<div class="gmail_signature">
<div dir="ltr">If life gives you melons, you may be dyslexic.
</div>
</div>
</div>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</body>
</html>