<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 04/29/2015 08:38 PM, Aric Wilisch
wrote:<br>
</div>
<blockquote
cite="mid:7411239F-2706-428D-8E88-1AE40EEEB7DB@gmail.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
Is it possible to setup a Master level FreeIPA domain, then have 3
sub level domains use it for authentication?
<div class=""><br class="">
</div>
<div class="">So master server at say <a moz-do-not-send="true"
href="http://ipa.domain.com" class="">ipa.domain.com</a>, then
have a secondary zone that is <a moz-do-not-send="true"
href="http://ipa2.sub1.domain.com" class="">ipa2.sub1.domain.com</a>.</div>
<div class=""><br class="">
</div>
<div class="">We have 3 different environments that need to stay
separated. We were going to have them all authenticate to an
Active Directory domain but getting that setup is turning into a
real issue. So if possible I would like to have a master level
IPA server, then three sub level IPA servers that authenticate
against it, then have our Windows Terminal Servers authenticate
against it as well if possible.</div>
<div class=""><br class="">
</div>
<div class="">So if there is documentation on how to set that up I
would appreciate a pointer, I haven’t been able to find it yet.</div>
<div class=""><br class="">
</div>
<div class="">Thanks much!<br class="">
</div>
<div apple-content-edited="true" class="">
<span class="Apple-style-span" style="border-collapse: separate;
border-spacing: 0px;">
<div class=""><br class="Apple-interchange-newline">
Regards,</div>
<div class="">------------------------------------------</div>
<div class="">Aric Wilisch</div>
<div class=""><a moz-do-not-send="true"
href="mailto:awilisch@gmail.com" class="">awilisch@gmail.com</a></div>
<div class=""><br class="">
</div>
</span><br class="Apple-interchange-newline">
<br class="Apple-interchange-newline">
</div>
<br class="">
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
You can have one IPA Kerberos realm spanning several zones but the
top level domain should be the same as the realm otherwise trust
would not work.<br>
I think Alexander would have some pointers. <br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</body>
</html>