On Thu, 2022-06-23 at 13:07 -0400, Ranbir via FreeIPA-users wrote:
Is it possible to remove the trust controller role from masters? I
the trust agent setup on two masters that I just wanted to handle the
trust agent role and now they're showing up as trust controllers,
I don't know why that happened since I've done this before.
I ended up running the uninstall and install again. I then ran,
"ipa-adtrust-install --add-agent" on the new master and it got setup as
an agent and controller again. :/ I double checked the docs, which say
to do exactly what I did.
I did the uninstall/install cycle again and went back to running the
"ipa-adtrust-install --add-agent" on the trust controller. After that
was done, I restarted the ipa services on the agent that was just
added. When I now look at the new master's server config, it correctly
shows its server roles to include the AD Trust Agent role and not the
controller role. That's exactly what I was looking for.
It seems the docs are incorrect or the ipa-adtrust-install command has
changed with the freeipa releases in RHEL 8+. In RHEL 7 (and its
downstream derivatives), running "ipa-adtrust-install --add-agent" only
added the AD Trust Agent role to the server the command was run on.