[Freeipa-users] HA Client Question

Hey folks, I just recently began planning the deployment of FreeIPA and have successfully made several test setups. Next step would be to integrate this in our new datacenter; so we are starting there from scratch. I understand HA on the server side. What boogles my head is HA on the *client* side. For example: Our pfsenses use a LDAP lookup against a single FQDN, and the cert must be valid (against any provided CA). Exporting the CA from freeIPA and importing that in pfsense is a cake. But what do I point the clients towards? Let's say I have 4 FreeIPA servers: - ipa01.auth.dc-01.company.com - ipa02.auth.dc-01.company.com - ipa03.auth.dc-01.company.com - ipa04.auth.dc-01.company.com Realm company.com, Kerberos COMPANY.COM. If I point the pfsense (I'll stick to that as an example) against ipa01.auth.dc-01.company.com and this server is offline, then no HA is given. DNS Delegation might yield *any* of the four servers, including the one offline, so a 25% fault chance in there. Second question, same area: If I want my users to have one single url for the FreeIPA webservice, like auth.company.com that follows the above solution then the self-signed and generated certs do not have this as altname. So summed up: - How can I make (ldap) clients access the current online server(s)? - How can I provide access to the webinterace to the current online server(s)? (Or is this simply by the magic of dns zone delegation and pure faith that always an online server will be hit?) Thanks for any advice! -Christian. -- Christian Reiss - email(a)christian-reiss.de /"\ ASCII Ribbon support(a)alpha-labs.net \ / Campaign X against HTML WEB alpha-labs.net / \ in eMails GPG Retrieval https://gpg.christian-reiss.de GPG ID ABCD43C5, 0x44E29126ABCD43C5 GPG fingerprint = 9549 F537 2596 86BA 733C A4ED 44E2 9126 ABCD 43C5 "It's better to reign in hell than to serve in heaven.", John Milton, Paradise lost.