[Freeipa-users] Advise for the best way to achieve AD Caching?

[Petr Spacek]

On 5.5.2016 06:28, David LeVene wrote:
> Hey All,
> 
> I'm looking for a bit of direction around the best way to configure/setup an on-site cache &/or replica from an AD Server which will be uni-directional (AD -> IPA/slapd)
> 
> The master are multiple AD Servers located around the place, and we exist in a place which is outside of the core network and that network link is a single point of failure.
> 
> What I want to achieve is in the event we lose connectivity with the world users can still authenticate, but if someone is disabled/updated at the top level it replicates down. I've got a test AD Server & have been reviewing IPA, but have hit an issue in that I can't get software installed on the AD Masters for the 389 dir sync software.
> 
> Currently I've configured a synchronization based solution with one way replication from the AD Masters -> IPA. This works fine and I can see all the users being created in IPA - but as the passwords can't be synced without installing software I can't use this method.

All methods which can work completely off-line will require access to keys on
AD server. This means either some additional software on AD side OR having
proper AD server which is hosted locally. This could theoretically be Samba 4
AD server if you want to try that.

If your clients are sufficiently new you can try to use SSSD everywhere but it
comes with own limitations, e.g. users who never logged in before will not be
able to login when the network link is down.

I hope this help.

Petr^2 Spacek


> Another nice thing would be to have a separate domain/tree available so we can split up the staff that are from the master servers and some client related user/passes that won't be in the Global Directory - but managed from the same place.
> 
> Are there any other setup's that will achieve what I require? Have seen slapd with proxy cache but I'm not sure on this options either and configuring slapd with all the ldif files manually seems a little daunting at first sight.
> 
> Thanks in advance,
> David