Does ISC’s KEA support Dynamic DNS for Active Directory-based DNS on OPNsense?

[loaderladdy]

KEA's documentation on integration with AD DNS, found here GSS-TSIG Integration with External Systems states the following:

Kea provides support for DNS updates, which can be protected using Transaction Signatures (or TSIG). This protection is often adequate. However, some systems, in particular Active Directory (AD) on Microsoft Windows servers, have chosen to adopt a more complex GSS-TSIG approach that offers additional capabilities, such as using negotiated dynamic keys.

Kea supports GSS-TSIG to protect DNS updates sent by the Kea DHCP-DDNS (D2) server in a hook, called libddns_gss_tsig.so.

However, searching my OPNsense filesystem I cannot find Kea's hook file "libddns_gss_tsig.so"

What I want to know is there a way to install the necessary Kea GSS-TSIG file on OPNsense?.

I use my OPNsense device as the front door for my homelab, and as I work with AD my homelab has AD installed, so integrating Kea DDNS with AD DNS would be great.

I know Windows DHCP supports DDNS, but I wanted a rock-solid solution that keeps my household happy, and running Windows DHCP doesn't fit that desired outcome after a power cut.

Any help or advice on this is greatly appreciated.

[(MARLOO)]

searching my OPNsense filesystem I cannot find Kea's hook file "libddns_gss_tsig.so.What I want to know is there a way to install the necessary Kea GSS-TSIG file on OPNsense? "

it is not installable as a package .

OPNsense package isn't built that way..there is no file to copy in

Let Windows clients self-register via option 81 (Client FQDN), or move only D2 (kea-dhcp-ddns) to a Linux VM built with Kerberos enabled.

Don't use a shared-key TSIG on an AD-integrated zone set to Secure only

On the power cut: the DC is the real dependency, not the DHCP host --> the clients can register themselves once it's up