Chapter 12. Preparing the system for IdM client installation

download PDF

Ensure your system meets the following conditions before you install an Identity Management (IdM) client.

12.1. Supported versions of RHEL for installing IdM clients

An Identity Management deployment in which IdM servers are running on the latest minor version of Red Hat Enterprise Linux 9 supports clients that are running on the latest minor versions of:

  • RHEL 7
  • RHEL 8
  • RHEL 9
While other client systems, for example Ubuntu, can work with IdM 9 servers, Red Hat does not provide support for these clients.

12.2. DNS requirements for IdM clients

Client installer by default tries to search for _ldap._tcp.DOMAIN DNS SRV records for all domains that are parent to its hostname. For example, if a client machine has a hostname, the installer will try to retrieve an IdM server hostname from, and DNS SRV records, respectively. The discovered domain is then used to configure client components (for example, SSSD and Kerberos 5 configuration) on the machine.

However, the hostnames of IdM clients are not required to be part of the primary DNS domain. If the client machine hostname is not in a subdomain of an IdM server, pass the IdM domain as the --domain option of the ipa-client-install command. In that case, after the installation of the client, both SSSD and Kerberos components will have the domain set in their configuration files and will use it to autodiscover IdM servers.

Additional resources

12.3. Port requirements for IdM clients

Identity Management (IdM) clients connect to a number of ports on IdM servers to communicate with their services.

On IdM client, these ports must be open in the outgoing direction. If you are using a firewall that does not filter outgoing packets, such as firewalld, the ports are already available in the outgoing direction.

Additional resources

12.4. IPv6 requirements for IdM clients

Identity Management (IdM) does not require the IPv6 protocol to be enabled in the kernel of the host that you want to enroll into IdM. For example, if your internal network only uses the IPv4 protocol, you can configure the System Security Services Daemon (SSSD) to only use IPv4 to communicate with the IdM server. You can do this by inserting the following line into the [domain/NAME] section of the /etc/sssd/sssd.conf file:

lookup_family_order = ipv4_only

Additional resources

  • For more information about the lookup_family_order option, see the sssd.conf(5) man page.

12.5. Installing packages required for an IdM client

Installing the ipa-client package automatically installs other required packages as dependencies, such as the System Security Services Daemon (SSSD) packages.


  • Install the ipa-client package:
# dnf install ipa-client
Red Hat logoGithubRedditYoutubeTwitter


Try, buy, & sell


About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

© 2024 Red Hat, Inc.