A few notes about the things I discovered testing FreeIPA about February, 2017.
- It’s NOT A Windows domain controller. This should be obvious just checking the basic docs.
- It conflicts with samba. The first impulse is to deny this claim because, hey, there’s ample documentation about adding samba and some kind of connector/backend from FreeIPA to Samba. However FreeIPA forces /etc/hosts format to be opposite Samba’s demanded order. For example 192.168.1.222 freeipa freeipa.linuxenvironment.com and 192.168.1.222 freeipa.linuxenvironment.com freeipa. I’m not sure how one gets around this.
- The LDAP server must be dedicated to freeIPA. Putting other databases in the same 389 server causes some confusion on the part of the FreeIPA environment. The systemd scripts just don’t work with more than one 389 database.
- Use a virtual machine like kvm. FreeIPA can run as an lxc-container. BUT auditing does not work. This is a limitation of the lxc container.
- /etc/hosts file parsing is quite strict. If things don’t work while the system configures itself, check the arrangement in /etc/hosts.