[Freeipa-users] Re: Kerberos setup in IPA server and IPA clients

I have setup an Idm environment with replica and AD trust. I have the following realms and domains: IPADEV.EXAMPLE.LOCAL is the IPA realm with the domain ipadev.example.local EXAMPLE.LOCAL is the AD realm with dns domain example.local All the clients have the DNS domain example.local and are/will be enrolled to the IPA domain. In the IPA servers I had the following entries (added by the installation process) in /etc/krb5.conf : server ===== [domain_realm] .ipadev.example.local = IPADEV.EXAMPLE.LOCAL ipadev.example.local = IPADEV.EXAMPLE.LOCAL ipadev04.example.local = IPADEV.EXAMPLE.LOCAL .example.local = IPADEV.EXAMPLE.LOCAL example.local = IPADEV.EXAMPLE.LOCAL .example.local = IPADEV.EXAMPLE.LOCAL example.local = IPADEV.EXAMPLE.LOCAL client ==== [domain_realm] .ipadev.example.local = IPADEV.EXAMPLE.LOCAL ipadev.example.local = IPADEV.EXAMPLE.LOCAL ipadev02.example.local = IPADEV.EXAMPLE.LOCAL .example.local = IPADEV.EXAMPLE.LOCAL example.local = IPADEV.EXAMPLE.LOCAL Because of various issues (either replication did not work, either clients could not query AD), I had removed entries on the server config (at some point i had .example.local = EXAMPLE.LOCAL but that broke the replication between ipa servers ) and now it looks like that: [domain_realm] .ipadev.example.local = IPADEV.EXAMPLE.LOCAL ipadev.example.local = IPADEV.EXAMPLE.LOCAL ipadev04.example.local = IPADEV.EXAMPLE.LOCAL My question is , how should the [domain_realm] section of the /etc/krb5.conf look like on both ipa server and ipa client ? Is dns_lookup_realm = true and dns_lookup_kdc = true enough in the [libdefaults] section or should these realm be explicitly added ? What are the tradeoffs of not using them ?