Domain controller role requirements

This page contains the functional requirements for the Domain Controller role - that is, the things the role is expected to do when it's working properly. If Domain Controller is a Featured Role, then according to the Fedora_Release_Criteria, these requirements must be met to some extent for each Fedora Server pre-release and release: refer to the criteria pages for the exact details of which requirements must be met at each milestone.

Unless otherwise stated, it is always assumed that the role has been correctly deployed and configured by the system administrator.

Core requirements

1. Multiple clients must be able to enrol and unenrol in the domain
2. Client systems must be able to authenticate users with Kerberos
3. The FreeIPA configuration web UI must be available and allow at least basic configuration of user accounts and permissions

Requirements

1. The Domain Controller must be capable of serving LDAP requests, including TLS-encrypted LDAP requests, on port 389
2. The Domain Controller must be capable of serving LDAPS (LDAP encrypted with SSL) requests on port 636
3. The Domain Controller must be capable of returning LDAP and LDAPS search results using simple auth or SASL/GSSAPI auth
4. The Domain Controller must be capable of serving DNS host records on port 53
5. The Domain Controller must serve DNS SRV records for ldap and kerberos on port 53

Test cases

1. QA:Testcase_realmd_join_sssd (and other realmd_join tests in Category:Realmd_Test_Cases)
2. QA:Testcase FreeIPA web ui