[Freeipa-users] Re: replica in DMZ with trust-agent

On Fri, 21 Jun 2024, slek kus via FreeIPA-users wrote:

Hi I deployed a third replica in a dmz network for clients that do not route to the main ipa masters. Not sure if this is a workable setup. I can join clients using --fixed-primary and can logon with AD (one-way trust). This third replica has the trust-agent role. I might be approaching this incorrectly. Posting here for advise, has anyone attepted this and how to approach? It seems to be working, except the sudo rules.

I have posted a diagram here: https://ibb.co/WkQj9yD

It would be best if you could provide actual logs, not pictures. And ideally those logs should come from both a client and a server.