4.2. Recovering from a VM snapshot among a partially-working environment

Procedure

1. Remove all replication agreements to the lost servers. See Uninstalling an IdM server.
2. Boot the desired snapshot of the CA replica VM.

3. Remove any replication agreements between the restored server and any lost servers.

   [root@restored-CA-replica ~]# ipa server-del lost-server1.example.com
   [root@restored-CA-replica ~]# ipa server-del lost-server2.example.com
   ...

4. If the restored server does not have replication agreements to any of the servers still in production, connect the restored server with one of the other servers to update the restored server.

   [root@restored-CA-replica ~]# ipa topologysegment-add
   Suffix name: domain
   Left node: restored-CA-replica.example.com
   Right node: server3.example.com
   Segment name [restored-CA-replica.com-to-server3.example.com]: new_segment
   ---------------------------
   Added segment "new_segment"
   ---------------------------
     Segment name: new_segment
     Left node: restored-CA-replica.example.com
     Right node: server3.example.com
     Connectivity: both

5. Review Directory Server error logs at /var/log/dirsrv/slapd-YOUR-INSTANCE/errors to see if the CA replica from the snapshot correctly synchronizes with the remaining IdM servers.

6. If replication on the restored server fails because its database is too outdated, reinitialize the restored server.

   [root@restored-CA-replica ~]# ipa-replica-manage re-initialize --from server2.example.com

7. If the database on the restored server is correctly synchronized, continue by deploying additional replicas with the desired services (CA, DNS) according to Installing an IdM replica.

Verification

1. Test the Kerberos server on every replica by successfully retrieving a Kerberos ticket-granting ticket as an IdM user.

   [root@server ~]# kinit admin
   Password for admin@EXAMPLE.COM:
   
   [root@server ~]# klist
   Ticket cache: KCM:0
   Default principal: admin@EXAMPLE.COM
   
   Valid starting       Expires              Service principal
   10/31/2019 15:51:37  11/01/2019 15:51:02  HTTP/server.example.com@EXAMPLE.COM
   10/31/2019 15:51:08  11/01/2019 15:51:02  krbtgt/EXAMPLE.COM@EXAMPLE.COM

2. Test the Directory Server and SSSD configuration on every replica by retrieving user information.

   [root@server ~]# ipa user-show admin
     User login: admin
     Last name: Administrator
     Home directory: /home/admin
     Login shell: /bin/bash
     Principal alias: admin@EXAMPLE.COM
     UID: 1965200000
     GID: 1965200000
     Account disabled: False
     Password: True
     Member of groups: admins, trust admins
     Kerberos keys available: True

3. Test the CA server on every CA replica with the ipa cert-show command.

   [root@server ~]# ipa cert-show 1
     Issuing CA: ipa
     Certificate: MIIEgjCCAuqgAwIBAgIjoSIP...
     Subject: CN=Certificate Authority,O=EXAMPLE.COM
     Issuer: CN=Certificate Authority,O=EXAMPLE.COM
     Not Before: Thu Oct 31 19:43:29 2019 UTC
     Not After: Mon Oct 31 19:43:29 2039 UTC
     Serial number: 1
     Serial number (hex): 0x1
     Revoked: False