Well, technically, I don't think IPA needs DNS entries simply for synchronization, so you could technically give it the same domain suffix. However, if you plan on using it for the purpose of clients to connect, it will need to be on its own domain.
The reason it is highly suggested for different domains to have different suffixes within DNS is because clients will 'dig' that domain for Kerberos and LDAP type records when looking for domain servers. Something like the below, for example:
# dig -t SRV _kerberos._tcp.EXAMPLE.COM.
If this returns both AD /and/ IPA servers, your clients will have a bad time.
-------- Original message --------
From: Striker Leggette via FreeIPA-users <freeipa-users@lists.fedorahosted.org>
Date: 6/14/17 8:12 PM (GMT-05:00)
To: FreeIPA users list <freeipa-users@lists.fedorahosted.org>
Cc: Striker Leggette <striker@terranforge.com>
Subject: [Freeipa-users] Re: FreeIPA - Active Directory integration and domain names
Yes
-------- Original message --------
From: bogusmaster--- via FreeIPA-users <freeipa-users@lists.fedorahosted.org>
Date: 6/14/17 6:06 AM (GMT-05:00)
To: freeipa-users@redhat.com
Cc: bogusmaster@o2.pl
Subject: [Freeipa-users] FreeIPA - Active Directory integration and domain names
Hi,
I have a question regarding establishing one-way trust between FreeIPA
and Active Directory. In the documentation it is stated that to use a
cross-forest trust it is required for FreeIPA to have a different domain
than that of Active Directory. Does it also apply to the synchronization
scenario?
Thank you
Bart
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org