samba - Nov 2016 - Making a Samba DC under a different domain

I am trying to determine if it is mandatory for the domain controllers's 
host FQDN to be within the same DNS domain as the realm's DNS domain.

For example: let's say I want the DC to be called smb1.int.example.net 
but I want the realm to be AD.EXAMPLE.NET.

I set "smb1" in /etc/hostname and mapping to the FQDN in /etc/hosts,
so
that "hostname -f" shows the desired FQDN
"smb1.int.example.net".

Then I run samba-tool domain provision --interactive, and change the 
offered realm from INT.EXAMPLE.NET to AD.EXAMPLE.NET. I then end up with:

Server Role:           active directory domain controller
Hostname:              smb1
NetBIOS Domain:        AD
DNS Domain:            ad.example.net
DOMAIN SID: S-1-5-21-895328253-630460385-2547770178

And LDAP contains:

# SMB1, Domain Controllers, ad.example.net
dn: CN=SMB1,OU=Domain Controllers,DC=ad,DC=example,DC=net
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: computer
cn: SMB1
...
name: SMB1
...
dNSHostName: smb1.ad.example.net
...
servicePrincipalName: HOST/smb1.ad.example.net
servicePrincipalName: HOST/smb1.ad.example.net/AD
servicePrincipalName: ldap/smb1.ad.example.net/AD
...

So it seems to have chosen smb1.ad.example.net (instead of 
smb1.int.example.net) for its hostname. Is that a hard-and-fast rule or 
can it be bypassed, and if so how?

Thanks,

Brian.

On Tue, 15 Nov 2016 12:34:52 +0000
Brian Candler via samba <samba at lists.samba.org> wrote:
> I am trying to determine if it is mandatory for the domain
> controllers's host FQDN to be within the same DNS domain as the
> realm's DNS domain.
> 
> For example: let's say I want the DC to be called
> smb1.int.example.net but I want the realm to be AD.EXAMPLE.NET.
> 
> I set "smb1" in /etc/hostname and mapping to the FQDN in
/etc/hosts,
> so that "hostname -f" shows the desired FQDN
"smb1.int.example.net".
> 
> Then I run samba-tool domain provision --interactive, and change the 
> offered realm from INT.EXAMPLE.NET to AD.EXAMPLE.NET. I then end up
> with:
> 
> Server Role:           active directory domain controller
> Hostname:              smb1
> NetBIOS Domain:        AD
> DNS Domain:            ad.example.net
> DOMAIN SID: S-1-5-21-895328253-630460385-2547770178
> 
> And LDAP contains:
> 
> # SMB1, Domain Controllers, ad.example.net
> dn: CN=SMB1,OU=Domain Controllers,DC=ad,DC=example,DC=net
> objectClass: top
> objectClass: person
> objectClass: organizationalPerson
> objectClass: user
> objectClass: computer
> cn: SMB1
> ...
> name: SMB1
> ...
> dNSHostName: smb1.ad.example.net
> ...
> servicePrincipalName: HOST/smb1.ad.example.net
> servicePrincipalName: HOST/smb1.ad.example.net/AD
> servicePrincipalName: ldap/smb1.ad.example.net/AD
> ...
> 
> So it seems to have chosen smb1.ad.example.net (instead of 
> smb1.int.example.net) for its hostname. Is that a hard-and-fast rule
> or can it be bypassed, and if so how?
> 
> Thanks,
> 
> Brian.
> 
> 
AD relies on DNS, so if the hostname of the machine that will become a
DC is 'something.ad.example.net' then the realm needs to be
'AD.EXAMPLE.NET'. If your registered dns name is
'ad.example.net' and
you already have dns servers running in this domain, you could change
the dns domain of your DC (before provisioning) to
'int.ad.example.net' and then provision the AD Domain with the realm
name 'INT.AD.EXAMPLE.NET'. You could then forward anything unknown to
the AD dns server (i.e. anything not in 'int.ad.example.net') to your
existing dns servers.

Rowland