19.2. Uninstalling an IdM client

Procedure

1. Enter the ipa-client-install --uninstall command:

   [root@client ~]# ipa-client-install --uninstall

2. Optional: Check that you cannot obtain a Kerberos ticket-granting ticket (TGT) for an IdM user:

   [root@client ~]# kinit admin
   kinit: Client 'admin@EXAMPLE.COM' not found in Kerberos database while getting initial credentials
   [root@client ~]#

   If a Kerberos TGT ticket has been returned successfully, follow the additional uninstallation steps in Uninstalling an IdM client: additional steps after multiple past installations.

3. On the client, remove old Kerberos principals from each identified keytab other than /etc/krb5.keytab:

   [root@client ~]# ipa-rmkeytab -k /path/to/keytab -r EXAMPLE.COM

4. On an IdM server, remove all DNS entries for the client host from IdM:

   [root@server ~]# ipa dnsrecord-del
   Record name: old-client-name
   Zone name: idm.example.com
   No option to delete specific record provided.
   Delete all? Yes/No (default No): true
   ------------------------
   Deleted record "old-client-name"

5. On the IdM server, remove the client host entry from the IdM LDAP server. This removes all services and revokes all certificates issued for that host:

   [root@server ~]# ipa host-del client.idm.example.com

   重要

   Removing the client host entry from the IdM LDAP server is crucial if you think you might re-enroll the client in the future, with a different IP address or a different hostname.