Using Containerized Identity Management Services

Use the atomic install rhel7/ipa-server publish --hostname fully_qualified_domain_name ipa-server-install command to start the installation.

The ipa-server-install setup script starts:

The log file for this installation can be found in /var/log/ipaserver-install.log
========================================
This program will set up the IPA Server.
[... output truncated ...]

The process is the same as when using the ipa-server-install utility to install a non-container server.

Use the atomic install rhel7/ipa-server publish --hostname fully_qualified_domain_name ipa-server-install --external-ca command to start the installation.

The ipa-server-install setup script starts:

The log file for this installation can be found in /var/log/ipaserver-install.log
========================================
This program will set up the IPA Server.
[... output truncated ...]

The process is the same as when using the ipa-server-install utility to install a non-container server.

The container installation script generates the certificate signing request (CSR) in the /var/lib/<container_name>/root/ipa.csr file. Submit the CSR to the external CA, and retrieve the issued certificate and the CA certificate chain for the issuing CA.

See Installing a Server with an External CA as the Root CA in the Linux Domain Identity, Authentication, and Policy Guide for details.

Copy the signed CA certificate and the root CA certificate into the /var/lib/<container_name>/ directory.

$ cp /root/{ipa,ca}.crt /var/lib/server-container/.

Use the atomic run command with the --external-cert-file option to specify the location of the certificates. Specify the location relative to the /data/ directory because the installer performs the call from inside the container

$ atomic run rhel7/ipa-server ipa-server-install --external-cert-file /data/ipa.crt --external-cert-file /data/ca.crt

Manually create the persistent storage directory for the container at /var/lib/<container_name>/:

$ mkdir -p /var/lib/ipa-server

Copy the files containing the certificate chain into the directory:

$ cp /root/server-*.p12 /var/lib/ipa-server/.

See Installing Without a CA in the Linux Domain Identity, Authentication, and Policy Guide for details on the required files.

Use the atomic install command, and provide the required certificates from the third-party authority:

$ atomic install --name server-container rhel7/ipa-server publish \
   --hostname server.example.com \
   ipa-server-install \
   --dirsrv-cert-file=/data/server-dirsrv-cert.p12 \
   --dirsrv-pin=1234 \
   --http-cert-file=/data/server-http-cert.p12 \
   --http-pin=1234 \
   --pkinit-cert-file=/data/server-pkinit-cert.p12 \
   --pkinit-pin=1234

The ipa-server-install setup script starts:

The log file for this installation can be found in /var/log/ipaserver-install.log
========================================
This program will set up the IPA Server.
[... output truncated ...]

The process is the same as when using the ipa-server-install utility to install a non-container server.

Use the atomic install rhel7/ipa-server publish --hostname fully_qualified_domain_name ipa-replica-install command to start the installation. Include the --server and --domain options to specify the host name and domain name of your Identity Management server.

Manually create the persistent storage directory for the container at /var/lib/<container_name>/:

$ mkdir -p /var/lib/ipa-server

Copy the files containing the certificate chain into the directory:

$ cp /root/server-*.p12 /var/lib/ipa-server/.

See Installing Without a CA in the Linux Domain Identity, Authentication, and Policy Guide for details on the required files.

Use the atomic install rhel7/ipa-server publish --hostname fully_qualified_domain_name ipa-replica-install command, include the --server and --domain options to specify the host name and domain name of your Identity Management server, and provide the required certificates from the third-party authority:

$ atomic install --name replica-container rhel7/ipa-server publish \
    --hostname replica.example.com \
    ipa-replica-install \
    --server server.example.com \
    --domain example.com \
    --dirsrv-cert-file=/data/replica-dirsrv-cert.p12 \
    --dirsrv-pin=1234 \
    --http-cert-file=/data/replica-http-cert.p12 \
    --http-pin=1234 \
    --pkinit-cert-file=/data/replica-pkinit-cert.p12 \
    --pkinit-pin=1234

Enroll the host system as an Identity Management replica against the container. If you want to decommission the container with the Identity Management server later, make sure you create the replica with a certificate authority (CA) configured.

See Installing and Uninstalling Identity Management Replicas.

Migrate the CA master responsibilities from the server in the container to the new replica on the host system.

See Promoting a Replica to a Master CA Server.

Decommission the server in the container.

See Chapter 5, Uninstalling Server and Replica Containers.

To ensure that a replica container belonging to an existing topology is properly removed from that topology, use the ipa server-del <container-host-name> command on any enrolled host.

This step is necessary because the atomic uninstall command does not:

Use the atomic uninstall command, and include the container name and image name:

$ atomic uninstall --name <container_name> rhel7/ipa-server

Start the sssd container installation by using the atomic install command, and provide the random password or credentials of an IdM user that is allowed to enroll new hosts. In most cases, this is the admin user.

# atomic install rhel7/sssd --password "4Re[>5]OB$3K($qYs:M&}B"
[... output truncated ...]
Service sssd.service configured to run SSSD container.
[... output truncated ...]

# atomic install rhel7/sssd -p admin -w <admin_password>
[... output truncated ...]
Service sssd.service configured to run SSSD container.
[... output truncated ...]

The atomic install rhel7/sssd command accepts standard ipa-client-install options. Depending on your configuration, you might need to provide additional information using these options. For example, if ipa-client-install cannot determine the host name of your server and the domain name, use the --server and --domain options:

# atomic install rhel7/sssd --password "4Re[>5]OB$3K($qYs:M&}B" --server <server.example.com> --domain <example.com>

--password=4Re[>5]OB$3K($qYs:M&}B
--server=server.example.com
--domain=example.com

Start SSSD in the container by using one of the following commands:

# atomic run rhel7/sssd

# systemctl start sssd

Optional. Confirm that the container is running:

# docker ps
CONTAINER ID        IMAGE
5859b9366f0f        rhel7/sssd

Optional. Confirm that SSSD on the Atomic Host resolves identities from the Identity Management domain.

Save the password of a user allowed to enroll systems to the Active Directory domain, such as the Administrator, in the /etc/sssd/realm-join-password file on the Atomic Host system:

# echo <password> > /etc/sssd/realm-join-password

Providing the password in the file is necessary because the realm join command does not accept the password as a command-line parameter.

Start the sssd container installation by using the atomic install command, and specify the realm that you want to join. If you are using the default Administrator user account for the operation:

# atomic install rhel7/sssd realm join <ad.example.com>
docker run --rm=true --privileged --net=host -v /:/host -e NAME=sssd -e IMAGE=rhel7/sssd -e HOST=/host rhel7/sssd /bin/install.sh realm join ad.example.com
Initializing configuration context from host ...
Password for Administrator:
Copying new configuration to host ...
Service sssd.service configured to run SSSD container.

If you are using another user account, specify it with the --user option:

# atomic install rhel7/sssd realm join --user <user_name> <ad.example.com>

Start SSSD in the container by using one of the following commands:

# atomic run rhel7/sssd

# systemctl start sssd

Optional. Confirm that the container is running:

# docker ps
CONTAINER ID        IMAGE
5859b9366f0f        rhel7/sssd

Optional. On the Atomic Host system, confirm that SSSD resolves identities from the Active Directory domain:

# id administrator@<ad.example.com>
uid=1397800500(administrator@ad.example.com) gid=1397800513(domain users@ad.example.com)

Start the SSSD container by using the atomic install command. For example:

# atomic install --opt1='--dns=192.0.2.1 --dns-search=idm.example.com --hostname=server.ad.example.com -e SSSD_CONTAINER_TYPE=application --net=default' --name=ad_sssd rhel7/sssd realm join -v ad.example.com

The previous example creates an SSSD application container named ad_sssd. Pass the DNS server IP address, search domain, host name, and realm join command to atomic install to automatically join SSSD running in the container to the Active Directory domain.

Repeat this step for each identity provider for which you want to provide an SSSD container.

Start the container. For example:

# atomic run ad_sssd

Save the password of a user allowed to enroll systems to the Active Directory domain, such as the Administrator, in the /etc/sssd/realm-join-password file on the Atomic Host system:

# echo <password> > /etc/sssd/realm-join-password

Providing the password in the file is necessary because the realm join command does not accept the password as a command-line parameter.

Start the sssd container installation by using the atomic install command, and specify the realm that you want to join. If you are using the default Administrator user account for the operation:

# atomic install --opt1='--dns=<DNS_server_IP> --dns-search=<DNS_domain> --hostname=<host_name> -e SSSD_CONTAINER_TYPE=application --net=default' rhel7/sssd realm join -v <ad.example.com>
docker run --rm=true --privileged --net=host -v /:/host -e NAME=sssd -e IMAGE=rhel7/sssd -e HOST=/host rhel7/sssd /bin/install.sh realm join -v ad.example.com
Initializing configuration context from host ...
 * Resolving: _ldap._tcp.ad.example.com
 * Performing LDAP DSE lookup on: 192.168.122.105
...
Service sssd.service configured to run SSSD container.

If you are using another user account, specify it with the --user option:

# atomic install rhel7/sssd realm join --user <user_name> <ad.example.com>

Start SSSD in the container by using one of the following commands:

# atomic run rhel7/sssd

# systemctl start sssd

Optional. Confirm that the container is running:

# docker ps
CONTAINER ID        IMAGE
5859b9366f0f        rhel7/sssd

Optional. On the Atomic Host system, confirm that SSSD resolves identities from the Active Directory domain:

# id administrator@<ad.example.com>
uid=1397800500(administrator@ad.example.com) gid=1397800513(domain users@ad.example.com)

Pass the kinit option to the docker exec command. For example, to authenticate as the administrator user:

# docker exec -i <container_name> kinit administrator
Password for administrator@<DOMAIN>:

Optionally, verify that your Kerberos credential cache is stored in the Kerberos Credential Manager (KCM):

# docker exec -i <container_name> klist
Ticket cache: KEYRING:persistent:0:0
Default principal: Administrator@<DOMAIN>

Valid starting     Expires            Service principal
08/11/17 11:51:06  08/11/17 21:51:06  krbtgt/<DOMAIN>@<DOMAIN>
	renew until 08/18/17 11:51:03

Use the atomic uninstall command, and include the image name:

# atomic uninstall rhel7/sssd
[... output truncated ...]
Unenrolling client from IPA server
[... output truncated ...]
Client uninstall complete
[... output truncated ...]

Remove the Atomic Host system’s host entry on an Identity Management server. For example, from the command line:

$ ipa host-del <atomic.example.com>

To prevent the sssd service on the Atomic Host from attempting to start the container that is now unconfigured, remove the systemd unit file for the service and reload the systemd process:

# rm /etc/systemd/system/sssd.service
# systemctl daemon-reload