3.8. Re-enrolling a Client into the IdM Domain

If a client virtual machine has been destroyed and you still have its keytab, you can re-enroll the client:

Interactively, using administrator credentials. See Section 3.8.1, “Re-enrolling a Client Interactively Using the Administrator Account”.
Non-interactively, using a previously backed-up keytab file. See Section 3.8.2, “Re-enrolling a Client Non-interactively Using the Client Keytab”.

Note

You can only re-enroll clients whose domain entry is still active. If you uninstalled a client (using ipa-client-install --uninstall) or disabled its host entry (using ipa host-disable), you cannot re-enroll it.

During re-enrollment, IdM performs the following:

Revokes the original host certificate
Generates a new host certificate
Creates new SSH keys
Generates a new keytab

3.8.1. Re-enrolling a Client Interactively Using the Administrator Account

Re-create the client machine with the same host name.
Run the ipa-client-install --force-join command on the client machine:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
```
ipa-client-install --force-join
```
```
# ipa-client-install --force-join
```
The script prompts for a user whose identity will be used to enroll the client. By default, this is the admin user:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
```
User authorized to enroll computers: admin
Password for admin@EXAMPLE.COM
```
```
User authorized to enroll computers: admin
Password for admin@EXAMPLE.COM
```

3.8.2. Re-enrolling a Client Non-interactively Using the Client Keytab

Re-enrollment using the client keytab is appropriate for automated installation or in other situations when using the administrator password is not feasible.

Back up the original client's keytab file, for example in the /tmp or /root directory.
Re-create the client machine with the same host name.
Re-enroll the client, and specify the keytab location using the --keytab option:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
```
ipa-client-install --keytab /tmp/krb5.keytab
```
```
# ipa-client-install --keytab /tmp/krb5.keytab
```
Note
The keytab specified in the --keytab option is only used when authenticating to initiate the enrollment. During the re-enrollment, IdM generates a new keytab for the client.

Torna in cima

Questo contenuto non è disponibile nella lingua selezionata.

3.8. Re-enrolling a Client into the IdM Domain

3.8.1. Re-enrolling a Client Interactively Using the Administrator Account

3.8.2. Re-enrolling a Client Non-interactively Using the Client Keytab

Formazione

Prova, acquista e vendi

Community

Informazioni sulla documentazione di Red Hat

Rendiamo l’open source più inclusivo

Informazioni su Red Hat

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links