Apple’s documentation is very weak regarding the possibly most important command-line tool of all: changeip – neither the manual nor the man page give much details how it really works.
Assuming you run your server as a gateway to the Internet, then you’ll have your public IP and the public DNS entries (Forward plus Reverse) on the Primary interface. The Secondary Interface will run on the private IP and likely use the server’s own DNS server for name resolution.
Will the changeip command let you choose the interface that your SSO environment will run on? Or will it always pick the primary interface and you should just use changeip to make sure that the server setup matches the IP and Reverse DNS of this interface?
For me it makes sense that everything runs on the primary interface every time, so when you want to use Kerberos for VPN dial-in etc. it will be available outside your LAN as well. But there are so many components involved that I’m unable to see if that’s really the case.
I’m going to test all this in the next days, but if someone has already found the answer to my questions then I’ll be happy to know.
TIA,
Norbert