john doe via FreeIPA-users wrote:

Are there any options to deploy it within an existing domain with the constraints being:

• no domain delegation

DNS domain delegation? Do you mean it doesn't delegate any domains or it doesn't require delegation?

• write access to the applicable zone file prohibited

IPA stores zones in LDAP, not flat files. You can limit write access to LDAP to specific users and/or groups.

• registering/using an external domain impossible; also no external nameserver access

Is a firewall insufficient to control nameserver access? Is this IPA server going to be Internet-facing or something? Credentials are required to read/write to IPA so that will control access. There is no switch for "allow client enrollment only from these domains" but not just anyone can enroll.

• FreeIPA allowing for no single label domain; hack to override not sensible if multi-forest windows connection where to be necessary in the future

IPA doesn't allow single lable DNS domains. How this relates to AD forest trust I have no idea.

• apparently no alternative to DNS as for Kerberos config files?

I don't understand the question. Do you mean for autodiscovery? You can hardcode hostnames all over and use only /etc/hosts if you want but the installation will be fragile and high maintenance.

rob