Chapter 7. Configuring DNS and realm settings for a trust

Procedure

1. Log in to the IdM Web UI with administrator privileges.
2. Click the Network Services tab.
3. Click the DNS tab.

4. In the drop down menu, click DNS Forward Zones.

   

5. Click the Add button.
6. In the Add DNS forward zone dialog box, add a zone name.
7. In the Zone forwarders item, click the Add button.
8. In the Zone forwarders field, add the IP address of the server for which you want to create the forward zone.

9. Click the Add button.

   

   The forwarded zone has been added to the DNS settings and you can verify it in the DNS Forward Zones settings. The Web UI informs you about success with the following pop-up message: DNS Forward Zone successfully added.

   Note

   After adding a forward zone to the configuration, the Web UI might display a warning about a DNSSEC validation failure.

   

   DNSSEC (Domain Name System Security Extensions) secures DNS data with a digital signature to protect DNS from attacks. This service is enabled by default in the IdM server. The warning appears because the remote DNS server does not use DNSSEC. Enable DNSSEC on the remote DNS server.

   If you cannot enable DNSSEC validation on the remote server, you can disable DNSSEC in the IdM server:

   1. Open the /etc/named/ipa-options-ext.conf file on your IdM server.

   2. Add the following DNSSEC parameters:

      dnssec-validation no;

   3. Save and close the configuration file.

   4. Restart the DNS service:

      # systemctl restart named

   Note that DNSSEC is only available as Technology Preview in IdM.

Procedure

1. Log in to the Windows Server.
2. Open Server Manager.
3. Open DNS Manager.

4. In Conditional Forwarders, add a new forwarder and enter:

   • DNS Domain: The fully qualified domain name, for example, server.idm.example.com
   • IP Address: The IP address of the IdM DNS server.
5. Save the settings.

Procedure

1. Run a DNS query for the Kerberos over UDP and LDAP over TCP service records.

   [admin@server ~]# dig +short -t SRV _kerberos._udp.idm.example.com.

   0 100 88 server.idm.example.com.

   [admin@server ~]# dig +short -t SRV _ldap._tcp.idm.example.com.

   0 100 389 server.idm.example.com.

   The commands return the SRV records for the IdM servers.

2. Run a DNS query for the TXT record with the IdM Kerberos realm name. The returned value should match the Kerberos realm you specified when installing IdM.

   [admin@server ~]# dig +short -t TXT _kerberos.idm.example.com.

   "IDM.EXAMPLE.COM"

   If the previous steps did not return all the expected records, update the DNS configuration with the missing records:

   • If your IdM environment uses an integrated DNS server, enter the ipa dns-update-system-records command without any options to update your system records:

     [admin@server ~]$ ipa dns-update-system-records

   • If your IdM environment does not use an integrated DNS server:

     1. On the IdM server, export the IdM DNS records into a file:

        [admin@server ~]$ ipa dns-update-system-records --dry-run --out dns_records_file.nsupdate

        The command creates a file named dns_records_file.nsupdate with the relevant IdM DNS records.

     2. Submit a DNS update request to your DNS server using the nsupdate utility and the dns_records_file.nsupdate file. For more information, see Updating External DNS Records Using nsupdate in RHEL 7 documentation. Alternatively, refer to your DNS server documentation for adding DNS records.

3. Verify that IdM is able to resolve service records for AD with a command that runs a DNS query for Kerberos and LDAP over TCP service records:

   [admin@server ~]# dig +short -t SRV _kerberos._tcp.dc._msdcs.ad.example.com.

   0 100 88 addc1.ad.example.com.

   [admin@server ~]# dig +short -t SRV _ldap._tcp.dc._msdcs.ad.example.com.

   0 100 389 addc1.ad.example.com.