<html><body><div style="color:#000; background-color:#fff; font-family:Courier New, courier, monaco, monospace, sans-serif;font-size:10pt"><div><span><br></span></div><div><br><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div class="yui_3_2_0_19_134145763601961" style="font-family: Courier New,courier,monaco,monospace,sans-serif; font-size: 10pt;"> <div class="yui_3_2_0_19_134145763601963" style="font-family: times new roman,new york,times,serif; font-size: 12pt;"> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Rob Crittenden <rcritten@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> Martin Kosek <mkosek@redhat.com> <br><b><span style="font-weight: bold;">Cc:</span></b> freeipa-devel <freeipa-devel@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Thursday, July 5,
2012 3:18 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-devel] [PATCH] 1032 allow multiple --server in client install, don't always set _srv_<br> </font> </div> <br>
Martin Kosek wrote:<br>> On 07/04/2012 12:12 AM, Rob Crittenden wrote:<br>>> If you pass in --server and --fixed-primary then don't add _srv_ to ipa_server<br>>> in sssd.conf.<br>>><br>>> This necessitates the desire to be able to provide multiple servers so make<br>>> --server accept multiple values. This represents the bulk of the code changes.<br>>> In every case we only use the additional values in sssd.conf.<br>>><br>>> I also made some minor tweaks to discovery. There were cases where DNS<br>>> discovery wasn't successful but we set dnsok anyway which could cause some<br>>> cascading issues.<br>>><br>>> There are a ton of possible corner cases with this so please, be brutal.<br>>><br>>> I tested the following against a DNS server that had SRV records and against<br>>> one that did not.<br>>><br>>> - ipa-client-install<br>>> -
ipa-client-install --server=ipa.example.com --domain=example.com<br>>> - ipa-client-install --server=ipa.example.com --server=ipa1.example.com<br>>> --domain-example.com<br>>> - ipa-client-install -server=ipa.example.com --server=ipa1.example.com<br>>> --domain-example.com --fixed-primary<br>>> - ipa-client-install -server=ipa.example.com --server=ipa1.example.com<br>>> --domain-example.com --fixed-primary --no-sssd<br>>> - ipa-client-install -server=ipa.example.com --server=ipa1.example.com<br>>> --domain-example.com --no-sssd<br>>><br>>> rob<br>><br>> I did various checks, generally the patch behaves ok, I did not find any major<br>> bug. I have just 2 questions/suggestions:<br>><br>> 1) Since we allow more fixed servers to be passed as --server parameter, we<br>> could name them all in /etc/krb5.conf in "kdc" and "admin_server" options when<br>> DNS is not OK instead of
writing just the first one in the list. Kerberos tools<br>> then should be able to fall-back when some of them is not available.<br><br>Sure, that makes sense. Done.<br><br>> 2) What DNS discovery is not OK, we still add _srv_ to ipa_server option in<br>> sssd.conf. Is it intentional?<br><br>Yes, it was sort of a future-proofing if SRV records are ever made <br>available.<br><br>rob<br><br></div></div></blockquote><div class="yui_3_2_0_19_134145763601961" style="font-family: Courier New,courier,monaco,monospace,sans-serif; font-size: 10pt;"><div class="yui_3_2_0_19_134145763601963" style="font-family: times new roman,new york,times,serif; font-size: 12pt;">Could I request an option to not add _srv_ at all, like a --no-dns-discovery option. This way those of us who unfortunately are in situations where we can't create SRV records at all can have it designated at install time? Otherwise I have to edit the config files afterwards
anyway to get rid of it.<br><br>It could be made default false, of course, but if set the _srv_ entry would not be added.<br><br></div></div><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"><div style="font-family: Courier New, courier, monaco, monospace, sans-serif; font-size: 10pt;"><div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> </div> </div> </blockquote></div> </div></body></html>