How to setup IDM Replica [Rocky 9] – Technologie Hub Wien

Set the existing idm server as the system DNS server.

Install required packets:

dnf update
dnf install ipa-server ipa-client ipa-server-dns

Open required ports (they also need to be open on the existing IPA-Server):

firewall-cmd --add-service={freeipa-ldap,freeipa-ldaps,dns,ntp,freeipa-replication}
firewall-cmd --runtime-to-permanent

Generate a new token:

Register the host as a client. (The server can also be specified with the –server directive, otherwhise it will autodiscover the ipa-server behind the dns):

[root@idm4 ~]# ipa-client-install --mkhomedir password=xxxTokenxxx
Usage: ipa-client-install [options]

ipa-client-install: error: Too many arguments provided
The ipa-client-install command failed.
[root@idm4 ~]# ipa-client-install --mkhomedir --password=8Np4YmMjK44BLDqAo7RodDu
This program will set up IPA client.
Version 4.11.0

Skip bnidm4.thub.local: not an IPA server
Discovery was successful!
Do you want to configure chrony with NTP server or pool address? [no]:
Client hostname: idm4.thub.local
Realm: THUB.LOCAL
DNS Domain: thub.local
IPA Server: idm2.thub.local
BaseDN: dc=thub,dc=local

Continue to configure the system with these values? [no]: yes
Synchronizing time
No SRV records of NTP servers found and no NTP server or pool address was provided.
Using default chrony configuration.
Attempting to sync time with chronyc.
Time synchronization was successful.
Do you want to download the CA cert from http://idm2.thub.local/ipa/config/ca.crt ?
(this is INSECURE) [no]: yes
Successfully retrieved CA cert
    Subject:     CN=Certificate Authority,O=THUB.LOCAL
    Issuer:      CN=Certificate Authority,O=THUB.LOCAL
    Valid From:  2022-12-11 09:43:25+00:00
    Valid Until: 2042-12-11 09:43:25+00:00

Enrolled in IPA realm THUB.LOCAL
Created /etc/ipa/default.conf
Configured /etc/sssd/sssd.conf
Systemwide CA database updated.
Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
SSSD enabled
Configured /etc/openldap/ldap.conf
Principal is not set when enrolling with OTP or PKINIT; using principal 'admin@thub.local' for 'getent passwd'.
Configured /etc/ssh/ssh_config
Configured /etc/ssh/sshd_config.d/04-ipa.conf
Configuring thub.local as NIS domain.
Configured /etc/krb5.conf for IPA realm THUB.LOCAL
Client configuration complete.
The ipa-client-install command was successful

Now install the replica server. This might take a while:

[root@idm4 ~]# ipa-replica-install --setup-ca --setup-dns --no-forwarders
Password for admin@THUB.LOCAL:
Lookup failed: Preferred host idm4.thub.local does not provide DNS.
Could not resolve hostname idm2.thub.local using DNS. Clients may not function properly. Please check your DNS setup. (Note that this check queries IPA DNS directly and ignores /etc/hosts.)
Continue? [no]: yes
Run connection check to master
Connection check OK
Disabled p11-kit-proxy
Configuring directory server (dirsrv). Estimated time: 30 seconds
  [1/40]: creating directory server instance
Validate installation settings ...
Create file system structures ...
Perform SELinux labeling ...
Create database backend: dc=thub,dc=local ...
Perform post-installation tasks ...
  [2/40]: tune ldbm plugin
  [3/40]: adding default schema
  [4/40]: enabling memberof plugin
  [5/40]: enabling winsync plugin
  [6/40]: configure password logging
  [7/40]: configuring replication version plugin
  [8/40]: enabling IPA enrollment plugin
  [9/40]: configuring uniqueness plugin
  [10/40]: configuring uuid plugin
  [11/40]: configuring modrdn plugin
  [12/40]: configuring DNS plugin
  [13/40]: enabling entryUSN plugin
  [14/40]: configuring lockout plugin
  [15/40]: configuring graceperiod plugin
  [16/40]: configuring topology plugin
  [17/40]: creating indices
  [18/40]: enabling referential integrity plugin
  [19/40]: configuring certmap.conf
  [20/40]: configure new location for managed entries
  [21/40]: configure dirsrv ccache and keytab
  [22/40]: enabling SASL mapping fallback
  [23/40]: restarting directory server
  [24/40]: creating DS keytab
  [25/40]: ignore time skew for initial replication
  [26/40]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 284 seconds elapsed
Update succeeded

  [27/40]: prevent time skew after initial replication
  [28/40]: adding sasl mappings to the directory
  [29/40]: updating schema
  [30/40]: setting Auto Member configuration
  [31/40]: enabling S4U2Proxy delegation
  [32/40]: initializing group membership
  [33/40]: adding master entry
  [34/40]: initializing domain level
  [35/40]: configuring Posix uid/gid generation
  [36/40]: adding replication acis
  [37/40]: activating sidgen plugin
  [38/40]: activating extdom plugin
  [39/40]: configuring directory to start on boot
  [40/40]: restarting directory server
Done configuring directory server (dirsrv).
Replica DNS records could not be added on master: Insufficient access: Insufficient 'add' privilege to add the entry 'idnsname=idm4,idnsname=thub.local.,cn=dns,dc=thub,dc=local'.
Configuring Kerberos KDC (krb5kdc)
  [1/6]: configuring KDC
  [2/6]: adding the password extension to the directory
  [3/6]: creating anonymous principal
  [4/6]: starting the KDC
  [5/6]: configuring KDC to start on boot
  [6/6]: enable PAC ticket signature support
Done configuring Kerberos KDC (krb5kdc).
Configuring kadmin
  [1/2]: starting kadmin
  [2/2]: configuring kadmin to start on boot
Done configuring kadmin.
Configuring directory server (dirsrv)
  [1/3]: configuring TLS for DS instance
  [2/3]: importing CA certificates from LDAP
  [3/3]: restarting directory server
Done configuring directory server (dirsrv).
Configuring the web interface (httpd)
  [1/22]: stopping httpd
  [2/22]: backing up ssl.conf
  [3/22]: disabling nss.conf
  [4/22]: configuring mod_ssl certificate paths
  [5/22]: setting mod_ssl protocol list
  [6/22]: configuring mod_ssl log directory
  [7/22]: disabling mod_ssl OCSP
  [8/22]: adding URL rewriting rules
  [9/22]: configuring httpd
Nothing to do for configure_httpd_wsgi_conf
  [10/22]: setting up httpd keytab
  [11/22]: configuring Gssproxy
  [12/22]: setting up ssl
  [13/22]: configure certmonger for renewals
  [14/22]: publish CA cert
  [15/22]: clean up any existing httpd ccaches
  [16/22]: enable ccache sweep
  [17/22]: configuring SELinux for httpd
  [18/22]: create KDC proxy config
  [19/22]: enable KDC proxy
  [20/22]: starting httpd
  [21/22]: configuring httpd to start on boot
  [22/22]: enabling oddjobd
Done configuring the web interface (httpd).
Configuring ipa-otpd
  [1/2]: starting ipa-otpd
  [2/2]: configuring ipa-otpd to start on boot
Done configuring ipa-otpd.
Custodia uses 'idm2.thub.local' as master peer.
Configuring ipa-custodia
  [1/4]: Generating ipa-custodia config file
  [2/4]: Generating ipa-custodia keys
  [3/4]: starting ipa-custodia
  [4/4]: configuring ipa-custodia to start on boot
Done configuring ipa-custodia.
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes
  [1/30]: creating certificate server db
  [2/30]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 5 seconds elapsed
Update succeeded

  [3/30]: creating ACIs for admin
  [4/30]: creating installation admin user
  [5/30]: configuring certificate server instance
  [6/30]: stopping certificate server instance to update CS.cfg
  [7/30]: backing up CS.cfg
  [8/30]: Add ipa-pki-wait-running
  [9/30]: secure AJP connector
  [10/30]: reindex attributes
  [11/30]: exporting Dogtag certificate store pin
  [12/30]: disabling nonces
  [13/30]: set up CRL publishing
  [14/30]: enable PKIX certificate path discovery and validation
  [15/30]: authorizing RA to modify profiles
  [16/30]: authorizing RA to manage lightweight CAs
  [17/30]: Ensure lightweight CAs container exists
  [18/30]: Ensuring backward compatibility
  [19/30]: destroying installation admin user
  [20/30]: starting certificate server instance
  [21/30]: Finalize replication settings
  [22/30]: configure certmonger for renewals
  [23/30]: Importing RA key
  [24/30]: configure certificate renewals
  [25/30]: Configure HTTP to proxy connections
  [26/30]: updating IPA configuration
  [27/30]: enabling CA instance
  [28/30]: importing IPA certificate profiles
Lookup failed: Preferred host idm4.thub.local does not provide CA.
  [29/30]: configuring certmonger renewal for lightweight CAs
  [30/30]: deploying ACME service
Done configuring certificate server (pki-tomcatd).
Configuring Kerberos KDC (krb5kdc)
  [1/1]: installing X509 Certificate for PKINIT
Done configuring Kerberos KDC (krb5kdc).
Applying LDAP updates
Upgrading IPA:. Estimated time: 1 minute 30 seconds
  [1/10]: stopping directory server
  [2/10]: saving configuration
  [3/10]: disabling listeners
  [4/10]: enabling DS global lock
  [5/10]: disabling Schema Compat
  [6/10]: starting directory server
  [7/10]: upgrading server
  [8/10]: stopping directory server
  [9/10]: restoring configuration
  [10/10]: starting directory server
Done.
Finalize replication settings
Restarting the KDC
dnssec-validation yes
Configuring DNS (named)
  [1/9]: generating rndc key file
  [2/9]: setting up our own record
  [3/9]: adding NS record to the zones
  [4/9]: setting up kerberos principal
  [5/9]: setting up LDAPI autobind
  [6/9]: setting up named.conf
created new /etc/named.conf
created named user config '/etc/named/ipa-ext.conf'
created named user config '/etc/named/ipa-options-ext.conf'
created named user config '/etc/named/ipa-logging-ext.conf'
  [7/9]: setting up server configuration
  [8/9]: configuring named to start on boot
  [9/9]: changing resolv.conf to point to ourselves
Done configuring DNS (named).
Restarting the web server to pick up resolv.conf changes
Configuring DNS key synchronization service (ipa-dnskeysyncd)
  [1/7]: checking status
  [2/7]: setting up bind-dyndb-ldap working directory
  [3/7]: setting up kerberos principal
  [4/7]: setting up SoftHSM
  [5/7]: adding DNSSEC containers
DNSSEC container exists (step skipped)
  [6/7]: creating replica keys
  [7/7]: configuring ipa-dnskeysyncd to start on boot
Done configuring DNS key synchronization service (ipa-dnskeysyncd).
Restarting ipa-dnskeysyncd
Restarting named
Updating DNS system records

Global DNS configuration in LDAP server is empty
You can use 'dnsconfig-mod' command to set global DNS options that
would override settings in local named.conf files

Configuring SID generation
  [1/7]: adding RID bases
RID bases already set, nothing to do
  [2/7]: creating samba domain object
Samba domain object already exists
  [3/7]: adding admin(group) SIDs
Admin SID already set, nothing to do
Admin group SID already set, nothing to do
  [4/7]: updating Kerberos config
'dns_lookup_kdc' already set to 'true', nothing to do.
  [5/7]: activating sidgen task
  [6/7]: restarting Directory Server to take MS PAC and LDAP plugins changes into account
  [7/7]: adding fallback group
Fallback group already set, nothing to do
Done.
The ipa-replica-install command was successful

Now you can go to the web gui of the new server and configure it to your liking.