Chapter 19. Renaming IdM client systems

Procedure

1. Enter the ipa-client-install --uninstall command:

   [root@client ~]# ipa-client-install --uninstall

   Copy to Clipboard

2. Optional: Check that you cannot obtain a Kerberos ticket-granting ticket (TGT) for an IdM user:

   [root@client ~]# kinit admin
   kinit: Client 'admin@EXAMPLE.COM' not found in Kerberos database while getting initial credentials
   [root@client ~]#

   Copy to Clipboard

   If a Kerberos TGT ticket has been returned successfully, follow the additional uninstallation steps in Uninstalling an IdM client: additional steps after multiple past installations.

3. On the client, remove old Kerberos principals from each identified keytab other than /etc/krb5.keytab:

   [root@client ~]# ipa-rmkeytab -k /path/to/keytab -r EXAMPLE.COM

   Copy to Clipboard

4. On an IdM server, remove all DNS entries for the client host from IdM:

   [root@server ~]# ipa dnsrecord-del
   Record name: old-client-name
   Zone name: idm.example.com
   No option to delete specific record provided.
   Delete all? Yes/No (default No): true
   ------------------------
   Deleted record "old-client-name"

   Copy to Clipboard

5. On the IdM server, remove the client host entry from the IdM LDAP server. This removes all services and revokes all certificates issued for that host:

   [root@server ~]# ipa host-del client.idm.example.com

   Copy to Clipboard
   Important

   Removing the client host entry from the IdM LDAP server is crucial if you think you might re-enroll the client in the future, with a different IP address or a different hostname.

Procedure

1. Check the /etc/krb5.conf.ipa file:

   • If the contents of the /etc/krb5.conf.ipa file are the same as the contents of the krb5.conf file prior to the installation of the IdM client, you can:

     1. Remove the /etc/krb5.conf file:

        # rm /etc/krb5.conf

        Copy to Clipboard

     2. Rename the /etc/krb5.conf.ipa file into /etc/krb5.conf:

        # mv /etc/krb5.conf.ipa /etc/krb5.conf

        Copy to Clipboard
   • If the contents of the /etc/krb5.conf.ipa file are not the same as the contents of the krb5.conf file prior to the installation of the IdM client, you can at least restore the Kerberos configuration to the state directly after the installation of the operating system:

   1. Re-install the krb5-libs package:

      # dnf reinstall krb5-libs

      Copy to Clipboard

      As a dependency, this command will also re-install the krb5-workstation package and the original version of the /etc/krb5.conf file.

2. Remove the var/log/ipaclient-install.log file if present.

1. On the RHEL Identity Management server, add a new keytab for every service identified in the Preparing an IdM client for its renaming.

   [root@server ~]# ipa service-add service_name/new-client-name

   Copy to Clipboard

2. Generate certificates for services that had a certificate assigned in the Preparing an IdM client for its renaming. You can do this:

   • Using the IdM administration tools. See Managing Certificates for Users, Hosts, and Services.
   • Using the certmonger utility
3. Re-add the client to the host groups identified in the Preparing an IdM client for its renaming.