KDC proxy URI records #746
Conversation
|
|
||
| # URI records for KDCProxy must have lower priority than for KDC, clients must | ||
| # prefer to connect directly to KDC | ||
| IPA_KDCPROXY_PRIORITY_PENALIZATION = 10 |
There was a problem hiding this comment.
Don't be so shy, give it a big boost of 100 or even 1000. It makes it a bit easier to manually tune relevance later. Priority is a 16bit unsigned int, https://tools.ietf.org/html/rfc7553#section-4.2 .
There was a problem hiding this comment.
I'm shy because with DNS locations we use +50, and users may get lost when I increase it too much
There was a problem hiding this comment.
And manual tune for IPA DNS records is currently unsupported, it will replace any custom change done by users during upgrade
There was a problem hiding this comment.
Does the DNS location system add +50 for all off-site locations?
|
I am not entirely sure we want to care for the cse where an admin disables KDC Proxy in an automatic fashion; otherwise we would also need to check if TCP or UDP are disabled and change that too. |
|
@simo5 we don't support manual changes of IPA system records, it is regenerated automatically, so any manual changes are overwritten when: new replica is added/replica is removed/user executes manually |
|
@MartinBasti In this case we need a way to tell the system what are the priorities and which protocols are enabled, priorities are important too, admins need to be able to change them as they see fit. |
|
@simo5 not really a 4.5 material then |
Enables creation of following records per each replica: KDC URI records: _kerberos.example.com. IN URI <prio> <weight> "krb5srv:M:tcp:ipaserver.example.com" _kpasswd.example.com. IN URI <prio> <weight> "krb5srv:M:tcp:ipaserver.example.com" _kerberos.example.com. IN URI <prio> <weight> "krb5srv:M:udp:ipaserver.example.com" _kpasswd.example.com. IN URI <prio> <weight> "krb5srv:M:udp:ipaserver.example.com" KDC proxy URI records: _kerberos.example.com. IN URI <prio>+10 <weight> "krb5srv:M:kkdcp:https://ipaserver.example.com/KdcProxy" _kpasswd.example.com. IN URI <prio>+10 <weight> "krb5srv:M:kkdcp:https://ipaserver.example.com/KdcProxy" URI records for kadmin discovery are not created because FreeIPA doesn't support kadmin. KDC URI records (tcp, udp) must have higher priority than KDC proxy (https) to prefer direct communication with KDC. Also there is a bug that prevents ipa-client-install to enroll client with using only KDC proxy in some cases (see https://pagure.io/freeipa/issue/6906). All records are created for each replica in topology as KDC proxy is enabled by default. (Please note if KDC proxy is manually disabled KDC Proxy records will be created anyway) See: https://k5wiki.kerberos.org/wiki/Projects/KDC_Discovery https://pagure.io/freeipa/issue/6337
|
We can probably defer. |
Automatic creation of KDC proxy URI records
Enables creation of following KDC proxy URL records per each replica:
Records are created for each replica in topology as KDC proxy is enabled
by default. (If KDC proxy is manually disabled this record will be
created anyway)
URI records for kadmin discovery are not created because FreeIPA doesn't
support kadmin.
See: https://k5wiki.kerberos.org/wiki/Projects/KDC_Discovery
https://pagure.io/freeipa/issue/6337
TODO
Postponed: Fix https://pagure.io/freeipa/issue/6906 to allow enroll FreeIPA clients using HTTPS KDC proxy