24.10. Deploying an IdM server with an external CA as the root CA using an Ansible playbook

Procedure

1. Run the Ansible playbook with the instructions for the first step of the installation, for example install-server-step1.yml:

   $ ansible-playbook --vault-password-file=password_file -v -i ~/MyPlaybooks/inventory ~/MyPlaybooks/install-server-step1.yml

2. Locate the ipa.csr certificate signing request file on the controller and submit it to the external CA.
3. Place the IdM CA certificate signed by the external CA in the controller file system so that the playbook in the next step can find it.

4. Run the Ansible playbook with the instructions for the final step of the installation, for example install-server-step2.yml:

   $ ansible-playbook -v -i ~/MyPlaybooks/inventory ~/MyPlaybooks/install-server-step2.yml

5. Choose one of the following options:

   • If your IdM deployment uses external DNS: add the DNS resource records contained in the /tmp/ipa.system.records.UFRPto.db file to the existing external DNS servers. The process of updating the DNS records varies depending on the particular DNS solution.

     ...
     Restarting the KDC
     Please add records in this file to your DNS system: /tmp/ipa.system.records.UFRBto.db
     Restarting the web server
     ...

   重要

   The server installation is not complete until you add the DNS records to the existing DNS servers.

   • If your IdM deployment uses integrated DNS:

     • Add DNS delegation from the parent domain to the IdM DNS domain. For example, if the IdM DNS domain is idm.example.com, add a name server (NS) record to the example.com parent domain.

       重要

       Repeat this step each time after an IdM DNS server is installed.

     • Add an _ntp._udp service (SRV) record for your time server to your IdM DNS. The presence of the SRV record for the time server of the newly-installed IdM server in IdM DNS ensures that future replica and client installations are automatically configured to synchronize with the time server used by this primary IdM server.