<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<blockquote
cite="mid:%3CCAPsaoBf5XQYQ23UotDZ3Ua7qPON=1WnopgYHnv0tuTALKA0Jhw@mail.gmail.com%3E"
type="cite">
<div dir="ltr">On Sun, Dec 11, 2016 at 11:31 PM, David Kupka <span
dir="ltr"><<a moz-do-not-send="true"
href="mailto:dkupka@redhat.com" target="_blank">dkupka@redhat.com</a>></span> wrote:<br>
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class="gmail-HOEnZb">
<div class="gmail-h5"><br>
</div>
</div>
yes you can do it. DNS domain and Kerberos realm are two
different things. It's common and AFAIK recommended to
capitalize DNS domain to get the realm but it's not
required.<br>
If you really want to have them different make sure:<br>
a) <a moz-do-not-send="true"
href="http://anotherdomain.com/" rel="noreferrer"
target="_blank">anotherdomain.com</a> is under your
control,<br>
b) you don't already have other Kerberos instance
(FreeIPA, MIT KRB5, MS AD, ...) with <a
moz-do-not-send="true" href="http://anotherdomain.com/"
rel="noreferrer" target="_blank">ANOTHERDOMAIN.COM</a> realm
deployed.<br>
<br>
With FreeIPA you can run<br>
# ipa-server-install --domain <a moz-do-not-send="true"
href="http://example.com/" rel="noreferrer"
target="_blank">example.com</a> --realm <a
moz-do-not-send="true" href="http://anotherdomain.com/"
rel="noreferrer" target="_blank">ANOTHERDOMAIN.COM</a><br>
<br>
But before you do, why do you want to have the realm
different from the domain?</blockquote>
<div><br>
</div>
</div>
</div>
</div>
</blockquote>
<br>
Question: what "domain" does the --domain option to
ipa-server-install actually refer to?<br>
<br>
The man page just says "
<meta charset="utf-8">
<meta charset="utf-8">
Your DNS domain name". But what does it actually alter?<br>
<br>
1. the DNS domain which holds the kerberos realm location
information? I don't think so; I think if you are searching for
realm FOO.COM you'll always look in the DNS under "foo.com", that's
a fixed relationship.<br>
<br>
2. the DNS name of the IPA server itself? But if set up correctly,
it already has an FQDN (as reported by "hostname -f"). And if you
give the "--hostname" option, that's a FQDN not a bare hostname.<br>
<br>
3. the DNS zone which IPA is authoritative for? But you can run IPA
without integrated DNS.<br>
<br>
4. the LDAP base DN? I guess that could be it: e.g. "--domain
foo.com" puts everything under tree "dc=foo,dc=com"?<br>
<br>
5. something else?<br>
<br>
Thanks,<br>
<br>
Brian.<br>
</body>
</html>