On Срд, 09 ліп 2025, Ronald Wimmer via FreeIPA-users wrote:
Currently, we operate three separate IPA instances across different
domains, each separated by firewalls. Since we require a unified user
and group base across all of them, managing this setup has become
quite cumbersome.
Would it be feasible to consolidate everything into a single IPA
instance serving all three domains? I'm aware of features like IPA
locations and the ability to configure additional realms, but would
those be sufficient?
In my opinion, one possible approach might be to set up a central IPA
environment with four servers, complemented by "satellite" replicas in
each domain. These could be prioritized by clients within their
respective networks using the locations feature.
It is unclear what do you mean by 'domains' and 'realms' here.
IPA deployment consists of only a single Kerberos realm that can include
systems deployed in multiple DNS domains. This deployment is a single
IPA organizational domain. A single IPA server can only host a single
IPA organizational domain. Vice-versa, a single IPA host (client or
server) can only be enrolled into a single IPA organizational domain,
represented by the single Kerberos realm.
There is no support and no plans for co-hosting multiple Kerberos realms
and organizational domains on the same physical IPA server.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland
--
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
Do not reply to spam, report it:
https://pagure.io/fedora-infrastructure/new_issue