DNS_realmdomains_integration#
__NOTOC__
Overview#
Related ticket: #3544
When AD trust is established, upon validation AD DC is capable to fetch information about trusted forest configuration, including additional name suffixes to use when creating routing to trusted domain. This gives an opportunity to make multiple DNS domain configurations supported in AD trust.
When AD DC knows about these additional DNS domains, it is capable to properly ask our KDCs for tickets for services in those domains and trust them via our trust.
This is how it looks from Windows side:
Win2012-multiple-suffixes.png#
For the domains that Windows manages as a DNS server, it exposes the same list via the same SMB interface.
Realmdomains information will also be used by SSSD to fetch and configure mapping between DNS domains and realms within IPA.
So from our side it means we need to hook into 'ipa dnszone-add' and
'ipa dnszone-del' to call 'ipa realmdomains-mod' for
non-forwarded zones. Any error when removing the domain with
'ipa realmdomains-mod --del-domain' should be ignored because the
domain in question might not be in the list of realm’s domains by
admin’s intention.
Also, a _kerberos TXT record containing the realm name should be
added to the DNS zone as a part of this process.
Use Cases#
Admin creates a new DNS zone in IPA using the
ipa dnszone-addcommand. As a result, a new entry is added to realmdomains and_kerberos TXTrecord is added to the DNS zone.Admin creates a new forwarded zone in IPA. No other side effects happen since the zone is not managed by IPA.
Admin adds a new domain
new-domain.comto the realmdomains object, usingipa realmdomains-mod --add-domain=new-domain.comoripa realmdomains-mod --domain={ipa-domain.org,new-domain.com}. If IPA manages the DNS zone fornew-domain.com,_kerberos TXTrecord is added to the zone.Admin deletes a domain
new-domain.comfrom the realmdomains object, usingipa realmdomains-mod --del-domain=new-domain.comoripa realmdomains-mod --domain={ipa-domain.org}. If IPA manages the DNS zone fornew-domain.comand_kerberos TXTrecord exists in this zone and contains the name of the realm, the record is deleted.Admin deletes a DNS zone using the
ipa dnszone-delcommand. If a domain with the same name as the zone exists in the realmdomains object, it is deleted.
Design#
Add functionality to the post_callback() methods of dnszone_add
and dnszone_del. These methods should now include the calls to
realmdomains-mod --add-domain and realmdomains-mod --del-domain,
respectively, in order to implement the addition/deletion of entries to
the realmdomain object upon DNS zone creation. The call to
realmdomains-mod will not be executed in the following cases:
for our own domain
for forwarded zones
for reverse zones
Implement the execute() method of realmdomains_mod. This method
should include the calls to dnsrecord_add and dnsrecord_del, in
order to implement the addition/deletion of the _kerberos TXT record
upon modification of the realmdomains object. The call to
dnsrecord_del will not be executed in the case of our own domain.
Add a normalizer to all the options of realmdomains_mod. The
normalizer should lowercase the arguments and strip the trailing dot.
Add new unit tests to cover these newly added functionalities.
Feature Management#
UI
N/A
CLI
N/A
Major configuration options and enablement#
N/A
Replication#
N/A
Updates and Upgrades#
N/A
Dependencies#
N/A
External Impact#
N/A