Red Hat Summit Red Hat SummitApoyoConsolaDesarrolladoresIniciar una pruebaContacto

Este contenido no está disponible en el idioma seleccionado.

Chapter 20. Preparing the system for an IdM replica installation

Verify system requirements and authorization for Identity Management (IdM) replica installation to ensure successful deployment and prevent installation failures.

  1. Ensure the target system meets the general requirements for IdM server installation.
  2. Ensure the target system meets the additional, version requirements for IdM replica installation.
  3. Authorize the target system for enrollment into the IdM domain.

20.1. Replica version requirements
Copiar enlace

Identity Management (IdM) replicas must run compatible RHEL and IdM versions to maintain proper configuration replication across the topology.

IdM replicas must run the same major version of RHEL and the same or later version of IdM as other IdM servers. This ensures that configuration can be properly copied from the server to the replica.

20.2. Displaying the IdM software version
Copiar enlace

Display the Identity Management (IdM) software version using the IdM WebUI, command-line tools, or package management to verify compatibility and track updates.

Procedure

  • In the IdM WebUI, choose About from the username menu at the upper-right to display the software version.

    Checking IdM Software Version

  • From the command line, use the ipa --version command: 

    [root@server ~]# ipa --version
     
    VERSION: 4.8.0, API_VERSION: 2.233

  • If IdM services are not operating properly, use the rpm utility to determine the version number of the ipa-server package that is currently installed: 

    [root@server ~]# rpm -q ipa-server
     
    ipa-server-4.8.0-11.module+el8.1.0+4247+9f3fd721.x86_64

20.3. Authorizing the installation of a replica on an IdM client
Copiar enlace

Authorize Identity Management (IdM) replica installation on an existing client system. You can promote a configured host to a replica to expand the domain’s capacity and ensure high availability for authentication services.

Choose Method 1 or Method 2 to authorize the installation:

Method 1 uses a two-step authorization to separate duties or automate the process. A senior administrator adds the client to the ipaservers host group, granting the machine elevated privileges. A junior administrator or automation script can then successfully run the ipa-replica-install utility on the host.

Method 2 uses direct authorization during the installation. You authorize the replica enrollment by providing the credentials of an IdM user with administrative privileges, either interactively or via an active Kerberos ticket.

Note

When installing an IdM replica, the system verifies if the provided Kerberos principal has the required privileges, which includes checking for user ID overrides. As a result, you can deploy a replica using the credentials of an AD administrator that is configured to act as an IdM administrator.

Procedure

  • Method 1: By using the ipaservers host group

    1. Log in to any IdM host as IdM admin: 

      $ kinit admin

    2. Add the client machine to the ipaservers host group: 

      $ ipa hostgroup-add-member ipaservers --hosts <client_hostname>
       
        Host-group: ipaservers
  Description: IPA server hosts
  Member hosts: server.example.com, client.example.com
-------------------------
Number of members added 1
-------------------------
      Note

      Membership in the ipaservers group grants the machine elevated privileges similar to the administrator’s credentials. Therefore, you can deploy a replica using the credentials of an AD administrator configured to act as an IdM administrator.

  • Method 2: By using a privileged user’s credentials

    Choose one of the following methods to authorize the replica installation by providing a privileged user’s credentials:

    • Let IdM prompt you for the credentials interactively after you start the ipa-replica-install utility. This is the default behavior.

    • Log in to the client as a privileged user immediately before running the ipa-replica-install utility. The default privileged user is admin: 

      $ kinit admin

Authorize Identity Management (IdM) replica installation on a system that is not yet enrolled in the domain. You can pre-configure the host and provide the credentials required to join the system to the realm as a replica.

Choose Method 1 or Method 2 to authorize the installation:

Method 1 uses a two-step authorization that you can use to separate duries or automate the process. A senior system administrator adds the external system as an IdM host and generates a random one-time password (OTP). A junior administrator or automation script then uses the OTP to enroll the replica.

Method 2 uses direct authorization during the installation. You authorize the replica enrollment by providing the credentials of an IdM user with administrative privileges.

Note

When installing an IdM replica, the system verifies if the provided Kerberos principal has the required privileges, which includes checking for user ID overrides. As a result, you can deploy a replica using the credentials of an AD administrator that is configured to act as an IdM administrator.

Procedure

  • Method 1: By using a random password generated on an IdM server

    1. Log in as the administrator on any server in the domain: 

      $ kinit admin

    2. Add the external system as an IdM host. Use the --random option with the ipa host-add command to generate a random one-time password to be used for the subsequent replica installation. 

      $ ipa host-add replica.example.com --random
       
      --------------------------------------------------
Added host "replica.example.com"
--------------------------------------------------
  Host name: replica.example.com
  Random password: W5YpARl=7M.n
  Password: True
  Keytab: False
  Managed by: server.example.com

      The generated password will become invalid after you use it to enroll the machine into the IdM domain. It will be replaced with a proper host keytab after the enrollment is finished.

    3. Add the system to the ipaservers host group. 

      $ ipa hostgroup-add-member ipaservers --hosts replica.example.com
       
        Host-group: ipaservers
  Description: IPA server hosts
  Member hosts: server.example.com, replica.example.com
-------------------------
Number of members added 1
-------------------------
    Note

    Membership in the ipaservers group grants the machine elevated privileges similar to the administrator’s credentials. Therefore a junior system administrator can successfully run the ipa-replica-install utility on the host by providing the generated random password.

  • Method 2: By using a privileged user’s credentials

    The default privileged user is admin. No action is required prior to running the IdM replica installation utility. Add the principal name and password options (--principal admin --admin-password password) to the ipa-replica-install command directly during the installation.

Red Hat logoGithubredditYoutubeTwitter

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Ayudamos a los usuarios de Red Hat a innovar y alcanzar sus objetivos con nuestros productos y servicios con contenido en el que pueden confiar. Explore nuestras recientes actualizaciones.

Hacer que el código abierto sea más inclusivo

Red Hat se compromete a reemplazar el lenguaje problemático en nuestro código, documentación y propiedades web. Para más detalles, consulte el Blog de Red Hat.

Acerca de Red Hat

Ofrecemos soluciones reforzadas que facilitan a las empresas trabajar en plataformas y entornos, desde el centro de datos central hasta el perímetro de la red.

Theme

© 2026 Red HatVolver arriba