21.4. Installing an IdM replica without integrated DNS and with a CA
Follow this procedure to install an Identity Management (IdM) replica:
- Without integrated DNS
- With a certificate authority (CA)
When configuring a replica with a CA, the CA configuration of the replica must mirror the CA configuration of the other server.
For example, if the server includes an integrated IdM CA as the root CA, the new replica must also be installed with an integrated CA as the root CA. No other CA configuration is available in this case.
Including the --setup-ca option in the ipa-replica-install command copies the CA configuration of the initial server.
Prerequisites
- Ensure your system is prepared for an IdM replica installation.
Procedure
Enter
ipa-replica-installwith the--setup-caoption.# ipa-replica-install --setup-caAdd the newly created IdM DNS service records to your DNS server:
Export the IdM DNS service records into a file in the
nsupdateformat:$ ipa dns-update-system-records --dry-run --out dns_records_file.nsupdate-
Submit a DNS update request to your DNS server using the
nsupdateutility and the dns_records_file.nsupdate file. For more information, see Updating External DNS Records Using nsupdate in RHEL 7 documentation. Alternatively, refer to your DNS server documentation for adding DNS records.
Next steps
- In large deployments, you might want to tune specific parameters of IdM replicas for better performance. Consult the Tuning Performance in Identity Management title to find tuning instructions to best suit your scenario.