Managing replication in Identity Management

Procedure

1. Select IPA Server → Topology → Topology Graph.

2. Make changes to the topology:

   • You can move the topology graph nodes using the left mouse button:

     

     View larger image

     

   • You can zoom in and zoom out the topology graph using the mouse wheel:

     

     View larger image

     

   • You can move the canvas of the topology graph by holding the left mouse button:

     

     View larger image

     
3. If you make any changes to the topology that are not immediately reflected in the graph, click Refresh.

Procedure

1. Enter the ipa topologysegment-find command to show the current topology segments configured for the domain or CA suffixes. For example, for the domain suffix:

   $ ipa topologysegment-find
   Suffix name: domain
   -----------------
   1 segment matched
   -----------------
     Segment name: server1.example.com-to-server2.example.com
     Left node: server1.example.com
     Right node: server2.example.com
     Connectivity: both
   ----------------------------
   Number of entries returned 1
   ----------------------------

   Copy to Clipboard Toggle word wrap

   In this example, domain-related data is only replicated between two servers: server1.example.com and server2.example.com.

2. Optional: To display details for a particular segment only, enter the ipa topologysegment-show command:

   $ ipa topologysegment-show
   Suffix name: domain
   Segment name: server1.example.com-to-server2.example.com
     Segment name: server1.example.com-to-server2.example.com
     Left node: server1.example.com
     Right node: server2.example.com
     Connectivity: both

   Copy to Clipboard Toggle word wrap

Procedure

1. In the topology graph, hover your mouse over one of the server nodes.

   Figure 1.6. Domain or CA options

   

   View larger image

   
2. Click on the domain or the ca part of the circle depending on what type of topology segment you want to create.

3. A new arrow representing the new replication agreement appears under your mouse pointer. Move your mouse to the other server node, and click on it.

   Figure 1.7. Creating a new segment

   

   View larger image

   
4. In the Add topology segment window, click Add to confirm the properties of the new segment.

Procedure

1. Click on an arrow representing the replication agreement you want to remove. This highlights the arrow.

   Figure 1.9. Topology segment highlighted

   

   View larger image

   
2. Click Delete.

3. In the Confirmation window, click OK.

   IdM removes the topology segment between the two servers, which deletes their replication agreement. The topology graph now shows the updated replication topology:

   Figure 1.10. Topology segment deleted

   

   View larger image

   

Procedure

1. Optional: If you do not know the name of the specific replication segment that you want to remove, display all segments available. Use the ipa topologysegment-find command. When prompted, provide the required topology suffix: domain or ca. For example:

   $ ipa topologysegment-find
   Suffix name: domain
   ------------------
   8 segments matched
   ------------------
     Segment name: new_segment
     Left node: server1.example.com
     Right node: server2.example.com
     Connectivity: both
   
   ...
   
   ----------------------------
   Number of entries returned 8
   ----------------------------

   Copy to Clipboard Toggle word wrap

   Locate the required segment in the output.

2. Remove the topology segment joining the two servers:

   $ ipa topologysegment-del
   Suffix name: domain
   Segment name: new_segment
   -----------------------------
   Deleted segment "new_segment"
   -----------------------------

   Copy to Clipboard Toggle word wrap

   Deleting the segment removes the replication agreement.

Procedure

1. Select IPA Server → Topology → IPA Servers.

2. Click on the name of the server you want to delete.

   Figure 1.11. Selecting a server

   

   View larger image

   
3. Click Delete Server.

1. On another server, run the ipa server-del command to remove server1.example.com. The command removes all topology segments pointing to the server:

   [user@server2 ~]$ ipa server-del
   Server name: server1.example.com
   Removing server1.example.com from replication topology, please wait...
   ----------------------------------------------------------
   Deleted IPA server "server1.example.com"
   ----------------------------------------------------------

   Copy to Clipboard Toggle word wrap

2. Optional: On server1.example.com, run the ipa server-install --uninstall command to uninstall the server components from the machine.

   [root@server1 ~]# ipa server-install --uninstall

   Copy to Clipboard Toggle word wrap

Procedure

1. List the details about RUVs using the ipa-replica-manage list-ruv command. The command displays the replica IDs:

   $ ipa-replica-manage list-ruv
   
   server1.example.com:389: 6
   server2.example.com:389: 5
   server3.example.com:389: 4
   server4.example.com:389: 12

   Copy to Clipboard Toggle word wrap
   Important

   The ipa-replica-manage list-ruv command lists ALL replicas in the topology, not only the malfunctioning or improperly removed ones.

2. Remove obsolete RUVs associated with a specified replica using the ipa-replica-manage clean-ruv command. Repeat the command for every replica ID with obsolete RUVs. For example, if you know server1.example.com and server2.example.com are the malfunctioning or improperly removed replicas:

   ipa-replica-manage clean-ruv 6
   ipa-replica-manage clean-ruv 5

   Copy to Clipboard Toggle word wrap

Verification

1. Run ipa-replica-manage list-ruv again. If the command no longer displays any corrupt RUVs, the records have been successfully cleaned.

2. If the command still displays corrupt RUVs, clear them manually using this task:

   dn: cn=clean replica_ID, cn=cleanallruv, cn=tasks, cn=config
   objectclass: extensibleObject
   replica-base-dn: dc=example,dc=com
   replica-id: replica_ID
   replica-force-cleaning: no
   cn: clean replica_ID

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Copy the add-topologysegment.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/add-topologysegment.yml add-topologysegment-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the add-topologysegment-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipatopologysegment task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the suffix variable to either domain or ca, depending on what type of segment you want to add.
   • Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement.
   • Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement.
   • Ensure that the state variable is set to present.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to handle topologysegment
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
   - name: Add topology segment
       ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: domain
         left: server.idm.example.com
         right: replica.idm.example.com
         state: present

   Copy to Clipboard Toggle word wrap
5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory add-topologysegment-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Copy the add-topologysegments.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/add-topologysegments.yml add-topologysegments-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the add-topologysegments-copy.yml file for editing.

4. Adapt the file by setting the following variables in the vars section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.

   • For every topology segment, add a line in the ipatopology_segments section and set the following variables:

     • Set the suffix variable to either domain or ca, depending on what type of segment you want to add.
     • Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement.
     • Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement.

5. In the tasks section of the add-topologysegments-copy.yml file, ensure that the state variable is set to present.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Add topology segments
     hosts: ipaserver
     gather_facts: false
   
     vars:
       ipaadmin_password: "{{ ipaadmin_password }}"
       ipatopology_segments:
       - {suffix: domain, left: replica1.idm.example.com , right: replica2.idm.example.com }
       - {suffix: domain, left: replica2.idm.example.com , right: replica3.idm.example.com }
       - {suffix: domain, left: replica3.idm.example.com , right: replica4.idm.example.com }
       - {suffix: domain+ca, left: replica4.idm.example.com , right: replica1.idm.example.com }
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Add topology segment
       ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: "{{ item.suffix }}"
         name: "{{ item.name | default(omit) }}"
         left: "{{ item.left }}"
         right: "{{ item.right }}"
         state: present
       loop: "{{ ipatopology_segments | default([]) }}"

   Copy to Clipboard Toggle word wrap
6. Save the file.

7. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory add-topologysegments-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Copy the check-topologysegments.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/check-topologysegments.yml check-topologysegments-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the check-topologysegments-copy.yml file for editing.

4. Adapt the file by setting the following variables in the vars section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.

   • For every topology segment, add a line in the ipatopology_segments section and set the following variables:

     • Set the suffix variable to either domain or ca, depending on the type of segment you are adding.
     • Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement.
     • Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement.

5. In the tasks section of the check-topologysegments-copy.yml file, ensure that the state variable is set to present.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Add topology segments
     hosts: ipaserver
     gather_facts: false
   
     vars:
       ipaadmin_password: "{{ ipaadmin_password }}"
       ipatopology_segments:
       - {suffix: domain, left: replica1.idm.example.com, right: replica2.idm.example.com }
       - {suffix: domain, left: replica2.idm.example.com , right: replica3.idm.example.com }
       - {suffix: domain, left: replica3.idm.example.com , right: replica4.idm.example.com }
       - {suffix: domain+ca, left: replica4.idm.example.com , right: replica1.idm.example.com }
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Check topology segment
       ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: "{{ item.suffix }}"
         name: "{{ item.name | default(omit) }}"
         left: "{{ item.left }}"
         right: "{{ item.right }}"
         state: checked
       loop: "{{ ipatopology_segments | default([]) }}"

   Copy to Clipboard Toggle word wrap
6. Save the file.

7. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory check-topologysegments-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Copy the verify-topologysuffix.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/ verify-topologysuffix.yml verify-topologysuffix-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the verify-topologysuffix-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipatopologysuffix section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the suffix variable to domain. If you are verifying the presence of the ca suffix, set the variable to ca.
   • Ensure that the state variable is set to verified. No other option is possible.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to handle topologysuffix
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Verify topology suffix
       ipatopologysuffix:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: domain
         state: verified

   Copy to Clipboard Toggle word wrap
5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory verify-topologysuffix-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Copy the reinitialize-topologysegment.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/reinitialize-topologysegment.yml reinitialize-topologysegment-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the reinitialize-topologysegment-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipatopologysegment section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the suffix variable to domain. If you are reinitializing the ca data, set the variable to ca.
   • Set the left variable to the left node of the replication agreement.
   • Set the right variable to the right node of the replication agreement.
   • Set the direction variable to the direction of the reinitializing data. The left-to-right direction means that data flows from the left node to the right node.

   • Ensure that the state variable is set to reinitialized.

     This is the modified Ansible playbook file for the current example:

     ---
     - name: Playbook to handle topologysegment
       hosts: ipaserver
     
       vars_files:
       - /home/user_name/MyPlaybooks/secret.yml
       tasks:
       - name: Reinitialize topology segment
         ipatopologysegment:
           ipaadmin_password: "{{ ipaadmin_password }}"
           suffix: domain
           left: server.idm.example.com
           right: replica.idm.example.com
           direction: left-to-right
           state: reinitialized

     Copy to Clipboard Toggle word wrap
5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory reinitialize-topologysegment-copy.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

   Copy to Clipboard Toggle word wrap

2. Copy the delete-topologysegment.yml Ansible playbook file provided by the ansible-freeipa package:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/delete-topologysegment.yml delete-topologysegment-copy.yml

   Copy to Clipboard Toggle word wrap
3. Open the delete-topologysegment-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipatopologysegment task section:

   • Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file.
   • Set the suffix variable to domain. Alternatively, if you are ensuring that the ca data are not replicated between the left and right nodes, set the variable to ca.
   • Set the left variable to the name of the IdM server that is the left node of the replication agreement.
   • Set the right variable to the name of the IdM server that is the right node of the replication agreement.
   • Ensure that the state variable is set to absent.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to handle topologysegment
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
   - name: Delete topology segment
       ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: domain
         left: replica01.idm.example.com
         right: replica02.idm.example.com:
         state: absent

   Copy to Clipboard Toggle word wrap
5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory delete-topologysegment-copy.yml

   Copy to Clipboard Toggle word wrap