第2章 Recovering a single server with replication

Procedure

1. From another replica in your environment, promote another CA replica in the environment to act as the new CA renewal server. See Changing and resetting IdM CA renewal server.
2. From another replica in your environment, remove replication agreements to the lost CA renewal server. See Removing server from topology using the CLI.
3. Install a new CA Replica to replace the lost CA replica. See Installing an IdM replica with a CA.
4. Update DNS to reflect changes in the replica topology. If IdM DNS is used, DNS service records are updated automatically.
5. Verify IdM clients can reach IdM servers. See Adjusting IdM clients during recovery.

Verification

1. Test the Kerberos server on the new replica by successfully retrieving a Kerberos Ticket-Granting-Ticket as an IdM user.

   [root@server ~]# kinit admin
   Password for admin@EXAMPLE.COM:
   
   [root@server ~]# klist
   Ticket cache: KCM:0
   Default principal: admin@EXAMPLE.COM
   
   Valid starting       Expires              Service principal
   10/31/2019 15:51:37  11/01/2019 15:51:02  HTTP/server.example.com@EXAMPLE.COM
   10/31/2019 15:51:08  11/01/2019 15:51:02  krbtgt/EXAMPLE.COM@EXAMPLE.COM

2. Test the Directory Server and SSSD configuration by retrieving user information.

   [root@server ~]# ipa user-show admin
     User login: admin
     Last name: Administrator
     Home directory: /home/admin
     Login shell: /bin/bash
     Principal alias: admin@EXAMPLE.COM
     UID: 1965200000
     GID: 1965200000
     Account disabled: False
     Password: True
     Member of groups: admins, trust admins
     Kerberos keys available: True

3. Test the CA configuration with the ipa cert-show command.

   [root@server ~]# ipa cert-show 1
     Issuing CA: ipa
     Certificate: MIIEgjCCAuqgAwIBAgIjoSIP...
     Subject: CN=Certificate Authority,O=EXAMPLE.COM
     Issuer: CN=Certificate Authority,O=EXAMPLE.COM
     Not Before: Thu Oct 31 19:43:29 2019 UTC
     Not After: Mon Oct 31 19:43:29 2039 UTC
     Serial number: 1
     Serial number (hex): 0x1
     Revoked: False