Issue #3261: ipa trust-add prints misleading information about required DNS setting - freeipa

freeipa

#3261 ipa trust-add prints misleading information about required DNS setting

Closed: Fixed None Opened 11 years ago by pspacek.

ipa trust-add command recommends DNS forwarder set-up but it should recommend normal DNS delegation in first place. Forwarders should be option of last resort.

Current output:

[root@cypher ~]# ipa trust-add --type=ad adlab.qe --admin Administrator --password
Active directory domain administrator's password:
ipa: ERROR: Unable to resolve domain controller for 'adlab.qe' domain.
Additional instructions:
IPA manages DNS, please configure forwarder to 'adlab.qe' domain using following CLI command. Make sure to replace DNS_SERVER and IP_ADDRESS by actual values corresponding to the trusted domain's DNS server:
    ipa dnszone-add adlab.qe --name-server=[DNS_SERVER] --admin-email='hostmaster@adlab.qe' --force --forwarder=[IP_ADDRESS] --forward-policy=only
When using Web UI, please create DNS zone for domain 'adlab.qe' first and then set forwarder and forward policy.

It should say somenthing like:

IPA manages DNS, please create delegation records (NS + A or AAAA records) for AD managed DNS domains.

NS record for name 'adlab' in zone 'qe' should countain *name* of AD name server. A or AAAA glue records for AD name server have to be created to ensure proper name server resolution.

If you set global forwarders (in named.conf or in LDAP) to value different from your AD server then you should specify forward policy to 'none' for zone 'qe.'. Implicit policy 'first' will send all queries to global forwarders and NS records will be ineffective.

You can set DNS forwarding up if you can't create delegation records for some reason.
... original text follows ...