Este contenido no está disponible en el idioma seleccionado.
Chapter 21. Installing an IdM replica
The following sections describe how to install an Identity Management (IdM) replica interactively, by using the command-line interface (CLI). The replica installation process copies the configuration of the existing server and installs the replica based on that configuration.
Red Hat recommends using Ansible roles to install replicas. By using Ansible roles, you can consistently install and customize multiple replicas.
Interactive and non-interactive methods that do not use Ansible are useful in topologies where, for example, the replica preparation is delegated to a user or a third party. You can also use these methods in geographically distributed topologies where you do not have access from the Ansible controller node.
Prerequisites
- You are installing one IdM replica at a time. The installation of multiple replicas at the same time is not supported.
Ensure your system is prepared for IdM replica installation.
ImportantIf this preparation is not performed, installing an IdM replica will fail.
For the individual types of replica installation procedures, see:
- Section 21.1, “Installing an IdM replica with integrated DNS and a CA”
- Section 21.2, “Installing an IdM replica with integrated DNS and no CA”
- Section 21.3, “Installing an IdM replica without integrated DNS and with a CA”
- Section 21.4, “Installing an IdM replica without integrated DNS and without a CA”
- Section 21.5, “Installing an IdM hidden replica”
To troubleshoot the replica installation procedure, see:
After the installation, see:
21.1. Installing an IdM replica with integrated DNS and a CA
Follow this procedure to install an Identity Management (IdM) replica:
- With integrated DNS
- With a certificate authority (CA)
You can do this to, for example, replicate the CA service for resiliency after installing an IdM server with an integrated CA.
When configuring a replica with a CA, the CA configuration of the replica must mirror the CA configuration of the other server.
For example, if the server includes an integrated IdM CA as the root CA, the new replica must also be installed with an integrated CA as the root CA. No other CA configuration is available in this case.
Including the --setup-ca option in the ipa-replica-install command copies the CA configuration of the initial server.
Prerequisites
- Ensure your system is prepared for an IdM replica installation.
Procedure
Enter
ipa-replica-installwith these options:-
--setup-dnsto configure the replica as a DNS server --forwarderto specify a per-server forwarder, or--no-forwarderif you do not want to use any per-server forwarders. To specify multiple per-server forwarders for failover reasons, use--forwardermultiple times.NoteThe
ipa-replica-installutility accepts a number of other options related to DNS settings, such as--no-reverseor--no-host-dns. For more information about them, see theipa-replica-install(1) man page.-
--setup-cato include a CA on the replica
For example, to set up a replica with an integrated DNS server and a CA that forwards all DNS requests not managed by the IdM servers to the DNS server running on IP 192.0.2.1:
# ipa-replica-install --setup-dns --forwarder 192.0.2.1 --setup-ca-
After the installation completes, add a DNS delegation from the parent domain to the IdM DNS domain. For example, if the IdM DNS domain is
idm.example.com, add a name server (NS) record to theexample.comparent domain.ImportantRepeat this step each time after you install an IdM DNS server.
21.2. Installing an IdM replica with integrated DNS and no CA
Follow this procedure to install an Identity Management (IdM) replica:
- With integrated DNS
- Without a certificate authority (CA) in an IdM environment in which a CA is already installed. The replica will forward all certificate operations to the IdM server with a CA installed.
Prerequisites
- Ensure your system is prepared for an IdM replica installation.
Procedure
Enter
ipa-replica-installwith these options:-
--setup-dnsto configure the replica as a DNS server -
--forwarderto specify a per-server forwarder, or--no-forwarderif you do not want to use any per-server forwarders. To specify multiple per-server forwarders for failover reasons, use--forwardermultiple times.
For example, to set up a replica with an integrated DNS server that forwards all DNS requests not managed by the IdM servers to the DNS server running on IP 192.0.2.1:
# ipa-replica-install --setup-dns --forwarder 192.0.2.1NoteThe
ipa-replica-installutility accepts a number of other options related to DNS settings, such as--no-reverseor--no-host-dns. For more information about them, see theipa-replica-install(1) man page.-
After the installation completes, add a DNS delegation from the parent domain to the IdM DNS domain. For example, if the IdM DNS domain is
idm.example.com, add a name server (NS) record to theexample.comparent domain.ImportantRepeat this step each time after you install an IdM DNS server.
21.3. Installing an IdM replica without integrated DNS and with a CA
Follow this procedure to install an Identity Management (IdM) replica:
- Without integrated DNS
- With a certificate authority (CA)
When configuring a replica with a CA, the CA configuration of the replica must mirror the CA configuration of the other server.
For example, if the server includes an integrated IdM CA as the root CA, the new replica must also be installed with an integrated CA as the root CA. No other CA configuration is available in this case.
Including the --setup-ca option in the ipa-replica-install command copies the CA configuration of the initial server.
Prerequisites
- Ensure your system is prepared for an IdM replica installation.
Procedure
Enter
ipa-replica-installwith the--setup-caoption.# ipa-replica-install --setup-ca
Add the newly created IdM DNS service records to your DNS server:
Export the IdM DNS service records into a file in the
nsupdateformat:$ ipa dns-update-system-records --dry-run --out dns_records_file.nsupdate
-
Submit a DNS update request to your DNS server using the
nsupdateutility and the dns_records_file.nsupdate file. For more information, see Updating External DNS Records Using nsupdate in RHEL 7 documentation. Alternatively, refer to your DNS server documentation for adding DNS records.
21.4. Installing an IdM replica without integrated DNS and without a CA
Follow this procedure to install an Identity Management (IdM) replica:
- Without integrated DNS
- Without a certificate authority (CA) by providing the required certificates manually. The assumption here is that the first server was installed without a CA.
You cannot install a server or replica using self-signed third-party server certificates because the imported certificate files must contain the full CA certificate chain of the CA that issued the LDAP and Apache server certificates.
Prerequisites
- Ensure your system is prepared for an IdM replica installation.
Procedure
Enter
ipa-replica-install, and provide the required certificate files by adding these options:-
--dirsrv-cert-file -
--dirsrv-pin -
--http-cert-file -
--http-pin
For details about the files that are provided using these options, see Section 5.1, “Certificates required to install an IdM server without a CA”.
For example:
# ipa-replica-install \ --dirsrv-cert-file /tmp/server.crt \ --dirsrv-cert-file /tmp/server.key \ --dirsrv-pin secret \ --http-cert-file /tmp/server.crt \ --http-cert-file /tmp/server.key \ --http-pin secret
NoteDo not add the
--ca-cert-fileoption. Theipa-replica-installutility takes this part of the certificate information automatically from the first server you installed.-
21.6. Testing an IdM replica
After creating a replica, check if the replica replicates data as expected. You can use the following procedure.
Procedure
Create a user on the new replica:
[admin@new_replica ~]$ ipa user-add test_userMake sure the user is visible on another replica:
[admin@another_replica ~]$ ipa user-show test_user
21.7. Connections performed during an IdM replica installation
Requests performed during an IdM replica installation lists the operations performed by ipa-replica-install, the Identity Management (IdM) replica installation tool.
| Operation | Protocol used | Purpose |
|---|---|---|
| DNS resolution against the DNS resolvers configured on the client system | DNS | To discover the IP addresses of IdM servers |
| Requests to ports 88 (TCP/TCP6 and UDP/UDP6) on the discovered IdM servers | Kerberos | To obtain a Kerberos ticket |
| JSON-RPC calls to the IdM Apache-based web-service on the discovered or configured IdM servers | HTTPS | IdM client enrollment; replica keys retrieval and certificate issuance if required |
| Requests over TCP/TCP6 to port 389 on the IdM server, using SASL GSSAPI authentication, plain LDAP, or both | LDAP | IdM client enrollment; CA certificate chain retrieval; LDAP data replication |
| Requests over TCP/TCP6 to port 22 on IdM server | SSH | To check if the connection is working |
| (optionally) Access over port 8443 (TCP/TCP6) on the IdM servers | HTTPS | To administer the Certificate Authority on the IdM server (only during IdM server and replica installation) |
