I want to deploy FreeIPA or Red Hat IdM in my existing environment
Currently my domain is managed by MS AD which is controlled by a separate group. Assume that changing anything in MS AD is going to be difficult or impossible for political reasons.
For Linux I recently configured systems to use Kerberos password authentication provided directly by MS AD, using SSSD on Enterprise Linux. Identity information is still provided on the local system.
My biggest hangup right now is figuring out how to propose the new domain name space.
Can I use a sub-domain of our MS AD domain and delegate control of it to FreeIPA?
I think it may be desirable to have the Kerberos configurations point directly at MS AD, it is already extremely resilient, why not take advantage of existing infrastructure? But will this me more trouble than it is worth? I am unsure of how things will integrate.
Take this into consideration:
Our host naming standard is something like this "app-id-dev/prd.domain.com". So for example: “server01dev.domain.com”
By policy we do not duplicate server id between dev/prd environments so I was thinking a nifty way to use sub-domains would be to convert the previous example to “server01.dev.domain.com”. A nice feature of this would be that when specifying the short name of a host we wouldn't need to specify dev/prd anymore if our domain search order is set up properly on the client.
Perceived Advantage: This would allow me to become the CA for those sub-domains. That should simplify anything certificate related down the road.
Perceived Disadvantage: What would that mean for authentication? I still want users to authenticate using a user name which already exists on the original domain. Example: user0321@DOMAIN.COM not user0321@DEV.DOMAIN.COM
Another doubt I have is whether there is any point in using MS AD Kerberos directly, because if Identity information is not available from the FreeIPA LDAP, it will still prevent the user from logging in properly unless they have a local identity on the client system.
If that is a real problem, it makes me wonder if it is possible to synchronize the FreeIPA LDAP information with AD, but then I think users would have to be created in the sub-domain.
Or, should I throw away any notion of using MS AD directly for resiliency and accept that I need to create a resilient FreeIPA/RH IdM environment?