Chapter 8. Configuring IdM clients in an Active Directory DNS domain

Procedure

1. Install the IdM client with the --domain=IPA_DNS_Domain option to ensure the System Security Services Daemon (SSSD) can communicate with the IdM servers:

   [root@idm-client.ad.example.com ~]# ipa-client-install --domain=idm.example.com

   This option disables the SRV record auto-detection for the Active Directory DNS domain.

2. Open the /etc/krb5.conf configuration file and locate the existing mapping for the Active Directory domain in the [domain_realm] section.

   .ad.example.com = IDM.EXAMPLE.COM
   ad.example.com = IDM.EXAMPLE.COM

3. Replace both lines with an entry mapping the fully qualified domain name (FQDN) of the Linux clients in the Active Directory DNS zone to the IdM realm:

   idm-client.ad.example.com = IDM.EXAMPLE.COM

   By replacing the default mapping, you prevent Kerberos from sending its requests for the Active Directory domain to the IdM Kerberos Distribution Center (KDC). Instead Kerberos uses auto-discovery through SRV DNS records to locate the KDC.

Procedure

1. Configure Kerberos by editing the /etc/krb5.conf file on the IdM client. In the [libdefaults] section, set ignore_acceptor_hostname to true. This allows the application to accept any host-based principal in its keytab:

   ignore_acceptor_hostname = true

2. Ensure a CNAME record exists in the Active Directory DNS, for example idm-client.ad.example.com, pointing to the IdM client’s A/AAAA record in the IdM DNS domain.

Procedure

1. On the IdM server, create a host entry for the AD-side alias. Use --force because the name resolves to a CNAME rather than an A/AAAA record.

   [root@idm-server.idm.example.com ~]# ipa host-add idm-client.ad.example.com --force

2. To allow the physical IdM host to manage the new alias entry in the IdM database, grant management permissions to the host.

   [root@idm-server.idm.example.com ~]# ipa host-add-managedby idm-client.ad.example.com \
         --hosts=idm-client.idm.example.com

3. On the IdM client, use ipa-getcert to request the certificate. Ensure that you include both the FQDN and the CNAME using the -D flags.

   [root@idm-client.idm.example.com ~]# ipa-getcert request -r \
         -f /etc/httpd/alias/server.crt \
         -k /etc/httpd/alias/server.key \
         -N CN=`hostname --fqdn` \
         -D `hostname --fqdn` \
         -D idm-client.ad.example.com \
         -K host/idm-client.idm.example.com@IDM.EXAMPLE.COM \
         -U id-kp-serverAuth

   In SSL/TLS, the client checks the Subject Alternative Name (SAN) field. By using -D twice, you are populating that SAN field with both names so that no matter which URL the user hits, the certificate remains valid.