freeipa

#6434 Installers: perform host enrollment also in domain level 0 replica install
Closed: Fixed Opened by mbabinsk.

Closed: Fixed
Reopen Issue

In order to unify the replica install workflow across domain levels, the domain level 0 installer has to perform a lightweight version of 'client install' consisting of:

  • configuring krb5.conf
  • getting host keytab
  • adding host entry to 'ipaservers' group

We can leverage the existing available workflow by creating host entry first and then either use OTP to enroll the would-be replica, or request a keytab using ipa-getkeytab and use it to perform enrollment. Other means are open to discussion.

Part of installer refactoring effort

master:

  • 19912796edf5d6427920ff67c33e6288223e0466 fix incorrect invocation of ipa-getkeytab during DL0 host enrollment
  • a6ec37255441294285fac58c9bf08129db110fac do partial host enrollment in domain level 0 replica install
  • 3d5161d7e943fc6d4d092d18fc980fd40d21a59f Separate function to purge IPA host principals from keytab

Metadata Update from @mbabinsk:
- Issue assigned to mbabinsk
- Issue set to the milestone: FreeIPA 4.5
Metadata
None
None
None
Normal
defect
IPA
#6392, #6429, #6405
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.