Managing replication in Identity Management

1. Select IPA Server → Topology → Topology Graph.
2. If you make any changes to the topology that are not immediately reflected in the graph, click Refresh.

Procedure

1. In the topology graph, hover your mouse over one of the server nodes.

   Figure 1.9. Domain or CA options

   
2. Click on the domain or the ca part of the circle depending on what type of topology segment you want to create.

3. A new arrow representing the new replication agreement appears under your mouse pointer. Move your mouse to the other server node, and click on it.

   Figure 1.10. Creating a new segment

   
4. In the Add topology segment window, click Add to confirm the properties of the new segment.

Procedure

1. Click on an arrow representing the replication agreement you want to remove. This highlights the arrow.

   Figure 1.12. Topology segment highlighted

   
2. Click Delete.

3. In the Confirmation window, click OK.

   IdM removes the topology segment between the two servers, which deletes their replication agreement. The topology graph now shows the updated replication topology:

   Figure 1.13. Topology segment deleted

   

Procedure

1. [Optional] If you do not know the name of the specific replication segment that you want to remove, display all segments available. Use the ipa topologysegment-find command. When prompted, provide the required topology suffix: domain or ca. For example:

   $ ipa topologysegment-find
   Suffix name: domain
   ------------------
   8 segments matched
   ------------------
     Segment name: new_segment
     Left node: server1.example.com
     Right node: server2.example.com
     Connectivity: both
   
   ...
   
   ----------------------------
   Number of entries returned 8
   ----------------------------

   Locate the required segment in the output.

2. Remove the topology segment joining the two servers:

   $ ipa topologysegment-del
   Suffix name: domain
   Segment name: new_segment
   -----------------------------
   Deleted segment "new_segment"
   -----------------------------

   Deleting the segment removes the replication agreement.

Procedure

1. Select IPA Server → Topology → IPA Servers.

2. Click on the name of the server you want to delete.

   Figure 1.14. Selecting a server

   
3. Click Delete Server.

Procedure

1. List the details about RUVs using the ipa-replica-manage list-ruv command. The command displays the replica IDs:

   $ ipa-replica-manage list-ruv
   
   server1.example.com:389: 6
   server2.example.com:389: 5
   server3.example.com:389: 4
   server4.example.com:389: 12

   Important

   The ipa-replica-manage list-ruv command lists ALL replicas in the topology, not only the malfunctioning or improperly removed ones.

2. Remove obsolete RUVs associated with a specified replica using the ipa-replica-manage clean-ruv command. Repeat the command for every replica ID with obsolete RUVs. For example, if you know server1.example.com and server2.example.com are the malfunctioning or improperly removed replicas:

   ipa-replica-manage clean-ruv 6
   ipa-replica-manage clean-ruv 5

Verification

1. Run ipa-replica-manage list-ruv again. If the command no longer displays any corrupt RUVs, the records have been successfully cleaned.

2. If the command still displays corrupt RUVs, clear them manually using this task:

   dn: cn=clean replica_ID, cn=cleanallruv, cn=tasks, cn=config
   objectclass: extensibleObject
   replica-base-dn: dc=example,dc=com
   replica-id: replica_ID
   replica-force-cleaning: no
   cn: clean replica_ID

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the add-topologysegment.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/add-topologysegment.yml add-topologysegment-copy.yml

3. Open the add-topologysegment-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipatopologysegment task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the suffix variable to either domain or ca, depending on what type of segment you want to add.
   • Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement.
   • Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement.
   • Ensure that the state variable is set to present.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to handle topologysegment
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
   - name: Add topology segment
       ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: domain
         left: server.idm.example.com
         right: replica.idm.example.com
         state: present

5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory add-topologysegment-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the add-topologysegments.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/add-topologysegments.yml add-topologysegments-copy.yml

3. Open the add-topologysegments-copy.yml file for editing.

4. Adapt the file by setting the following variables in the vars section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.

   • For every topology segment, add a line in the ipatopology_segments section and set the following variables:

     • Set the suffix variable to either domain or ca, depending on what type of segment you want to add.
     • Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement.
     • Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement.

5. In the tasks section of the add-topologysegments-copy.yml file, ensure that the state variable is set to present.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Add topology segments
     hosts: ipaserver
     gather_facts: false
   
     vars:
       ipaadmin_password: "{{ ipaadmin_password }}"
       ipatopology_segments:
       - {suffix: domain, left: replica1.idm.example.com , right: replica2.idm.example.com }
       - {suffix: domain, left: replica2.idm.example.com , right: replica3.idm.example.com }
       - {suffix: domain, left: replica3.idm.example.com , right: replica4.idm.example.com }
       - {suffix: domain+ca, left: replica4.idm.example.com , right: replica1.idm.example.com }
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Add topology segment
       ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: "{{ item.suffix }}"
         name: "{{ item.name | default(omit) }}"
         left: "{{ item.left }}"
         right: "{{ item.right }}"
         state: present
       loop: "{{ ipatopology_segments | default([]) }}"

6. Save the file.

7. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory add-topologysegments-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the check-topologysegments.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/check-topologysegments.yml check-topologysegments-copy.yml

3. Open the check-topologysegments-copy.yml file for editing.

4. Adapt the file by setting the following variables in the vars section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.

   • For every topology segment, add a line in the ipatopology_segments section and set the following variables:

     • Set the suffix variable to either domain or ca, depending on the type of segment you are adding.
     • Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement.
     • Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement.

5. In the tasks section of the check-topologysegments-copy.yml file, ensure that the state variable is set to present.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Add topology segments
     hosts: ipaserver
     gather_facts: false
   
     vars:
       ipaadmin_password: "{{ ipaadmin_password }}"
       ipatopology_segments:
       - {suffix: domain, left: replica1.idm.example.com, right: replica2.idm.example.com }
       - {suffix: domain, left: replica2.idm.example.com , right: replica3.idm.example.com }
       - {suffix: domain, left: replica3.idm.example.com , right: replica4.idm.example.com }
       - {suffix: domain+ca, left: replica4.idm.example.com , right: replica1.idm.example.com }
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Check topology segment
       ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: "{{ item.suffix }}"
         name: "{{ item.name | default(omit) }}"
         left: "{{ item.left }}"
         right: "{{ item.right }}"
         state: checked
       loop: "{{ ipatopology_segments | default([]) }}"

6. Save the file.

7. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory check-topologysegments-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the verify-topologysuffix.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/ verify-topologysuffix.yml verify-topologysuffix-copy.yml

3. Open the verify-topologysuffix-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipatopologysuffix section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the suffix variable to domain. If you are verifying the presence of the ca suffix, set the variable to ca.
   • Ensure that the state variable is set to verified. No other option is possible.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to handle topologysuffix
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Verify topology suffix
       ipatopologysuffix:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: domain
         state: verified

5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory verify-topologysuffix-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the reinitialize-topologysegment.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/reinitialize-topologysegment.yml reinitialize-topologysegment-copy.yml

3. Open the reinitialize-topologysegment-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipatopologysegment section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the suffix variable to domain. If you are reinitializing the ca data, set the variable to ca.
   • Set the left variable to the left node of the replication agreement.
   • Set the right variable to the right node of the replication agreement.
   • Set the direction variable to the direction of the reinitializing data. The left-to-right direction means that data flows from the left node to the right node.

   • Ensure that the state variable is set to reinitialized.

     This is the modified Ansible playbook file for the current example:

     ---
     - name: Playbook to handle topologysegment
       hosts: ipaserver
     
       vars_files:
       - /home/user_name/MyPlaybooks/secret.yml
       tasks:
       - name: Reinitialize topology segment
         ipatopologysegment:
           ipaadmin_password: "{{ ipaadmin_password }}"
           suffix: domain
           left: server.idm.example.com
           right: replica.idm.example.com
           direction: left-to-right
           state: reinitialized

5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory reinitialize-topologysegment-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the delete-topologysegment.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/delete-topologysegment.yml delete-topologysegment-copy.yml

3. Open the delete-topologysegment-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipatopologysegment task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the suffix variable to domain. Alternatively, if you are ensuring that the ca data are not replicated between the left and right nodes, set the variable to ca.
   • Set the left variable to the name of the IdM server that is the left node of the replication agreement.
   • Set the right variable to the name of the IdM server that is the right node of the replication agreement.
   • Ensure that the state variable is set to absent.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to handle topologysegment
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
   - name: Delete topology segment
       ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: domain
         left: replica01.idm.example.com
         right: replica02.idm.example.com:
         state: absent

5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory delete-topologysegment-copy.yml