[Freeipa-users] freeipa client in DMZ

[Baird, Josh]

I believe the sssd clients will need to communicate directly with your AD domain controllers, unfortunately.  I wish there was a clean way around this, since we have a ton of DC's in our HUB site, and I don't really want to poke holes in the firewall(s) for all of them.  

Would someone from sssd/IPA mind chiming in here?  What exactly needs to be open?  What DNS record can we query to get the exact list of DC's that need to be available?  Is there a way to restrict the list of domain controllers that certain sssd clients need to communicate with (for scenarios like this)?

Thanks,

Josh

> -----Original Message-----
> From: freeipa-users-bounces at redhat.com [mailto:freeipa-users-
> bounces at redhat.com] On Behalf Of Andy Thompson
> Sent: Tuesday, February 02, 2016 9:04 AM
> To: freeipa-users at redhat.com
> Subject: [Freeipa-users] freeipa client in DMZ
> 
> Are ports required to be open for a freeipa client in a DMZ to the AD DCs for
> trusted users to login?  I've got everything open to the IPA servers required
> and can lookup users and sudo rules and such but trusted users are not able
> to login.
> 
> Thanks
> 
> -andy
> 
> 
> 
> *** This communication may contain privileged and/or confidential
> information. It is intended solely for the use of the addressee. If you are not
> the intended recipient, you are strictly prohibited from disclosing, copying,
> distributing or using any of this information. If you received this
> communication in error, please contact the sender immediately and destroy
> the material in its entirety, whether electronic or hard copy. ***
> 
> 
> --
> Manage your subscription for the Freeipa-users mailing list:
> https://www.redhat.com/mailman/listinfo/freeipa-users
> Go to http://freeipa.org for more info on the project