Chapter 4. Managing DNS locations in IdM
Manage Identity Management (IdM) DNS locations to optimize traffic and reduce latency between clients and servers. Configuring these locations ensures that clients discover and prioritize the nearest available services.
4.1. Prerequisites Copy linkLink copied to clipboard!
- You understand the concept of DNS-based service discovery in IdM.
- You understand deployment considerations for DNS locations in IdM.
- You understand the concept of DNS time-to-live (TTL).
4.2. Creating DNS locations using the IdM Web UI Copy linkLink copied to clipboard!
Define new DNS locations through the IdM Web UI to group servers by physical or logical site. This organization helps the environment to direct client requests to local infrastructure, improving response times.
Prerequisites
- Your IdM deployment has integrated DNS.
- You have a permission to create DNS locations in IdM. For example, you are logged in as IdM admin.
Procedure
-
Open the
IPA Servertab. -
Select
Topologysubtab. -
Click
IPA Locationsin the navigation bar. - Click at the top of the locations list.
- Fill in the location name.
- Click the button to save the location.
- Optional: Repeat the steps to add further locations.
4.3. Creating DNS locations using the IdM CLI Copy linkLink copied to clipboard!
Add DNS locations via the command line with the ipa location-add command. This tool quickly registers new geographic or network-based sites within the Identity Management (IdM) database for future server assignment.
Prerequisites
- Your IdM deployment has integrated DNS.
- You have a permission to create DNS locations in IdM. For example, you are logged in as IdM admin.
Procedure
For example, to create a new location
germany, enter:$ ipa location-add germany---------------------------- Added IPA location "germany" ---------------------------- Location name: germany- Optional: Repeat the step to add further locations.
4.4. Assigning an IdM server to a DNS location using the IdM Web UI Copy linkLink copied to clipboard!
Associate specific Identity Management (IdM) servers with defined locations using the Topology tab in the IdM Web UI. Setting a service weight during this process further refines how clients distribute their connection attempts.
Prerequisites
- Your IdM deployment has integrated DNS.
- You are logged in as a user with a permission to assign a server to a DNS location, for example the IdM admin user.
-
You have
rootaccess to the host that you want to assign a DNS location to. - You have created the IdM DNS locations to which you want to assign servers.
Procedure
-
Open the
IPA Servertab. -
Select the
Topologysubtab. -
Click
IPA Serversin the navigation. - Click on the IdM server name.
Select a DNS location, and optionally set a service weight:
Assigning a server to a DNS location
- Click .
On the command line (CLI) of the host you assigned in the previous steps the DNS location to, restart the
namedservice:[root@idmserver-01 ~]# systemctl restart named- Optional: Repeat the steps to assign DNS locations to further IdM servers.
4.5. Assigning an IdM server to a DNS location using the IdM CLI Copy linkLink copied to clipboard!
Use the ipa server-mod command to link a server to a specific DNS location. Restarting the named service afterward activates the new routing logic, ensuring the server advertises itself to the correct local clients.
Prerequisites
- Your IdM deployment has integrated DNS.
- You are logged in as a user with a permission to assign a server to a DNS location, for example the IdM admin user.
-
You have
rootaccess to the host that you want to assign a DNS location to. - You have created the IdM DNS locations to which you want to assign servers.
Procedure
Optional: List all configured DNS locations:
[root@server ~]# ipa location-find----------------------- 2 IPA locations matched ----------------------- Location name: australia Location name: germany ----------------------------- Number of entries returned: 2 -----------------------------Assign the server to the DNS location. For example, to assign the location
germanyto the server idmserver-01.idm.example.com, run:# ipa server-mod idmserver-01.idm.example.com --location=germany[...] -------------------------------------------------- Modified IPA server "idmserver-01.idm.example.com" -------------------------------------------------- Servername: idmserver-01.idm.example.com Min domain level: 0 Max domain level: 1 Location: germany Enabled server roles: DNS server, NTP serverRestart the
namedservice on the host you assigned in the previous steps the DNS location to:# systemctl restart named- Optional: Repeat the steps to assign DNS locations to further IdM servers.
4.6. Configuring an IdM client to use IdM servers in the same location Copy linkLink copied to clipboard!
Point clients to a local DNS server via DHCP or manual network configuration. When the client’s primary DNS server resides in its assigned Identity Management (IdM) location, the client prioritizes local IdM services for all authentication and lookup tasks.
IdM servers are assigned to DNS locations as described in Assigning an IdM server to a DNS location using the IdM Web UI. Now you can configure the clients to use a DNS server that is in the same location as the IdM servers:
-
If a
DHCPserver assigns the DNS server IP addresses to the clients, configure theDHCPservice. For further details about assigning a DNS server in yourDHCPservice, see theDHCPservice documentation. -
If your clients do not receive the DNS server IP addresses from a
DHCPserver, manually set the IPs in the client’s network configuration. For further details about configuring the network on Red Hat Enterprise Linux, see the Configuring Network Connection Settings section in the Red Hat Enterprise Linux Networking Guide.
If you configure the client to use a DNS server that is assigned to a different location, the client contacts IdM servers in both locations.
Example 4.1. Different name server entries depending on the location of the client
The following example shows different name server entries in the /etc/resolv.conf file for clients in different locations:
Clients in Prague:
nameserver 10.10.0.1
nameserver 10.10.0.2
Clients in Paris:
nameserver 10.50.0.1
nameserver 10.50.0.3
Clients in Oslo:
nameserver 10.30.0.1
Clients in Berlin:
nameserver 10.30.0.1
If each of the DNS servers is assigned to a location in IdM, the clients use the IdM servers in their location.