Building a radius server, and decided this was an ideal application for a hidden replica.
I got some errors in the replica install, and the consistency check does not show a ghost replica (but does show my radius host in Replication Status.)
I run external DNS, this radius host has only has A and PTR records.
grant@radius01:~[20221117-13:45][#89]$ sudo ipa-replica-install --setup-ca --hidden-replica
WARNING: 376 existing users or groups do not have a SID identifier assigned.
Installer can run a task to have ipa-sidgen Directory Server plugin generate
the SID identifier for all these users. Please note, in case of a high
number of users and groups, the operation might lead to high replication
traffic and performance degradation. Refer to ipa-adtrust-install(1) man page
Do you want to run the ipa-sidgen task? [no]:
no
Run connection check to master
-snip-
[28/30]: importing IPA certificate profiles
Failed to import profile 'acmeIPAServerCert': Request failed with status 500: Non-2xx response from CA REST API: 500. . Running ipa-server-upgrade when installation is completed may resolve this issue.
[29/30]: configuring certmonger renewal for lightweight CAs
[30/30]: deploying ACME service
Done configuring certificate server (pki-tomcatd).
Configuring Kerberos KDC (krb5kdc)
[1/1]: installing X509 Certificate for PKINIT
Failed to configure PKINIT
Full PKINIT configuration did not succeed
The setup will only install bits essential to the server functionality
You can enable PKINIT after the setup completed using 'ipa-pkinit-manage'
Done configuring Kerberos KDC (krb5kdc).
Upgrading IPA:. Estimated time: 1 minute 30 seconds
[1/10]: stopping directory server
[2/10]: saving configuration
[3/10]: disabling listeners
-snip-
[7/7]: adding fallback group
Fallback group already set, nothing to do
The ipa-replica-install command was successful
grant@radius01:~[20221117-13:51][#90]$
grant@radius01:~[20221117-13:53][#92]$ ipa_check_consistency -d
PRODUCTION.EFILM.COM -W *************
FreeIPA servers: ef-idm01 ef-idm02 ef-idm03 ef-idm04 STATE
=========================================================================
Active Users 349 349 349 349 OK
Preserved Users 5 5 5 5 OK
User Groups 42 42 42 42 OK
Host Groups 23 23 23 23 OK
SUDO Rules 35 35 35 35 OK
DNS Zones ERROR ERROR ERROR ERROR OK
LDAP Conflicts NO NO NO NO OK
Ghost Replicas NO NO NO NO OK
Anonymous BIND YES YES YES YES OK
Replication Status ef-idm02 0 ef-idm03 0 ef-idm02 0 ef-idm01 0
ef-idm03 0 ef-idm01 0 ef-idm01 0
=========================================================================
grant@radius01:~[20221117-13:53][#93]$
grant@radius01:~[20221117-16:09][#88]$
sudo ipa-server-upgrade
[sudo] password for grant:
Upgrading IPA:. Estimated time: 1 minute 30 seconds
[1/11]: stopping directory server
[2/11]: saving configuration
[3/11]: disabling listeners
[4/11]: enabling DS global lock
[5/11]: disabling Schema Compat
[6/11]: starting directory server
Add failure attribute "cn" not allowed
[9/11]: stopping directory server
[10/11]: restoring configuration
[11/11]: starting directory server
-snip-
Migrating profile 'caAuditSigningCert'
[Ensuring presence of included profiles]
[Updating ACME configuration]
[Migrating to authselect profile]
[Create systemd-user hbac service and rule]
hbac service systemd-user already exists
[Enable server krb5.conf snippet]
[Adding ipa-ca alias to HTTP certificate]
Resubmitting HTTP cert tracking request
The IPA services were upgraded
The ipa-server-upgrade command was successful
grant@radius01:~[20221117-16:11][#89]$
ipa_check_consistency -d
PRODUCTION.EFILM.COM -W *************
FreeIPA servers: ef-idm01 ef-idm02 ef-idm03 ef-idm04 STATE
=========================================================================
Active Users 349 349 349 349 OK
Preserved Users 5 5 5 5 OK
User Groups 42 42 42 42 OK
Host Groups 23 23 23 23 OK
SUDO Rules 35 35 35 35 OK
DNS Zones ERROR ERROR ERROR ERROR OK
LDAP Conflicts NO NO NO NO OK
Ghost Replicas NO NO NO NO OK
Anonymous BIND YES YES YES YES OK
Replication Status ef-idm02 0 ef-idm03 0 ef-idm02 0 ef-idm01 0
ef-idm03 0 ef-idm01 0 ef-idm01 0
=========================================================================
grant@radius01:~[20221117-16:11][#90]$
grant@radius01:~[20221117-16:29][#91]$
sudo ipa-pkinit-manage status
The ipa-pkinit-manage command was successful
grant@radius01:~[20221117-16:29][#92]$
sudo ipa-pkinit-manage enable
Configuring Kerberos KDC (krb5kdc)
[1/1]: installing X509 Certificate for PKINIT
Failed to configure PKINIT
Full PKINIT configuration did not succeed
The setup will only install bits essential to the server functionality
You can enable PKINIT after the setup completed using 'ipa-pkinit-manage'
Done configuring Kerberos KDC (krb5kdc).
The ipa-pkinit-manage command was successful
grant@radius01:~[20221117-16:30][#93]$