![]() |
![]() |
![]() |
realmd | ![]() |
---|
realmd can discover FreeIPA domains and join the current computer as an account on a domain. This allows using domain users locally, and log into the local machine with FreeIPA domain credentials.
realmd discovers which domains or realms it can use or configure. It can discover and identify FreeIPA domains by looking up the appropriate DNS SRV records and by connecting to the server and retrieving its TLS certificate.
The following DNS SRV records are required to be present for realmd to identify a provided realm as an Kerberos domain.
# In this example the FreeIPA domain is 'domain.example.com'
_kerberos._udp.domain.example.com.
In addition realmd connects to the first
three KDC's listed and tests if they are FreeIPA servers. It
does this by connecting via HTTPS and retrieving their certificate
from the /ipa/config/ca.crt
location. It
compares this certificate with the one being used on KDC HTTPS
server. If they match the domain is treated as a FreeIPA domain.
To see how realmd is discovering a
particular domain name, try a command like the following. Using
the --verbose
argument displays verbose
discovery information.
$ realm --verbose discover domain.example.com
* Searching for kerberos SRV records for domain: _kerberos._udp.ipa.thewalter.lan
* Searching for MSDCS SRV records on domain: _kerberos._tcp.dc._msdcs.ipa.thewalter.lan
* dc.domain.example.com:88
* Trying to retrieve IPA certificate from dc.domain.example.com
* Retrieved IPA CA certificate verifies the HTTPS connection
* Found kerberos DNS records for: domain.example.com
* Found IPA style certificate for: domain.example.com
* Successfully discovered: domain.example.com
...