[Freeipa-users] Advise for the best way to achieve AD Caching?

[David LeVene]

Hey All,

I'm looking for a bit of direction around the best way to configure/setup an on-site cache &/or replica from an AD Server which will be uni-directional (AD -> IPA/slapd)

The master are multiple AD Servers located around the place, and we exist in a place which is outside of the core network and that network link is a single point of failure.

What I want to achieve is in the event we lose connectivity with the world users can still authenticate, but if someone is disabled/updated at the top level it replicates down. I've got a test AD Server & have been reviewing IPA, but have hit an issue in that I can't get software installed on the AD Masters for the 389 dir sync software.

Currently I've configured a synchronization based solution with one way replication from the AD Masters -> IPA. This works fine and I can see all the users being created in IPA - but as the passwords can't be synced without installing software I can't use this method.

Another nice thing would be to have a separate domain/tree available so we can split up the staff that are from the master servers and some client related user/passes that won't be in the Global Directory - but managed from the same place.

Are there any other setup's that will achieve what I require? Have seen slapd with proxy cache but I'm not sure on this options either and configuring slapd with all the ldif files manually seems a little daunting at first sight.

Thanks in advance,
David

This email and any attachments may contain confidential and proprietary information of Blackboard that is for the sole use of the intended recipient. If you are not the intended recipient, disclosure, copying, re-distribution or other use of any of this information is strictly prohibited. Please immediately notify the sender and delete this transmission if you received this email in error.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20160505/0cd74a12/attachment.htm>