mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2026-08-02 09:29:28 -05:00
Before establishing trust with AD it is recommended in documentation (and for many setups necessary) to create add DNS forwarder for AD domain. Bind config supplied by ipa server has dnssec validation enabled. If Windows server DNS does not have DNSSEC enabled with valid certificate, then bind will not be able to use it as forwarder and trust will not be established. Related to https://pagure.io/freeipa/issue/7889 Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>