[Freeipa-users] FW: FW: named and IpA

[Petr Spacek]

On 6.10.2014 15:17, Licause, Al (CSC AMS BCS - UNIX/Linux Network Support) wrote:
> Thanks very much for the additional input.  The configuration as you describe it is correct with a minor detail
> correction that I didn't notice earlier.    16.112.240.27 is the master for the osn.cxo.cpqcorp.net zone while
> 16.112.240.40 is a slave for that zone.    But as you have said, both are authoritative for that zone.
>
> I won't belabor the point and will move on to try a different configuration as my ultimate goal here is to create
> trust domains between a linux and an AD domain.     To that end I will reconfigure the current IdM server such that
> it is in a different subnet and domain.
>
> I just find it odd that when ipa is shutdown and named is restarted on the system designated as the IdM
> server, that dns works and the forwarders are not ignored as they are when ipa is running.

The reason is that authoritative data are stored in LDAP but global forwarding 
configuration (specified on ipa-server-install command line) is stored in 
/etc/named.conf.

LDAP server is not reachable when IPA is down so BIND cannot see zones in LDAP 
and "global" forwarding in named.conf causes that it accidentally works for you.

Forwarding is evil :-)

-- 
Petr^2 Spacek