lune voo via FreeIPA-users wrote:
Hello Rob.
Hm sorry for my ignorance, may you tell me how to use this ? Or maybe
you have some links I could use to have this ?
The necessary records for discovery during client enrollment are used
for failover in the ipa tool and sssd as well. These are DNS SRV
records. If you aren't running the embedded IPA DNS server you can get
the list of records necessary by running:
$ ipa dns-update-system-records --dry-run
In order for failover to work you need to not pass in --server during
client enrollment and let the client find an IPA Master to enroll against.
rob
Best regards.
Lune
Le ven. 5 juin 2020 à 21:36, Rob Crittenden <rcritten(a)redhat.com
<mailto:rcritten@redhat.com>> a écrit :
lune voo via FreeIPA-users wrote:
> Hello !
>
> I send you this mail because I have a question with the command
line of
> IPA and the high availability of IPA.
>
> I have the following setup :
>
> * 2 IPA servers (version 4.6.6) on RHEL 7.6 : S1 and S2
> * n IPA clients (version 3.0.0) on RHEL 6.6
>
> When I installed ipa clients with ipa-client-install, I specified both
> IPA servers.
> Yesterday, S1 crashed.
>
> On one of the client, the command line was not working anymore.
>
> ipa user-show myuser
>
> ipa: ERROR: cannot connect to
'ldapi://%2fvar%2frun%2fslapd-MYREALM.socket':
>
>
> It appears the command line use the following file to know which IPA
> server to contact :
> /etc/ipa/default.conf
>
> In this file, I saw that there was only S1 mentioned :
>
> # cat /etc/ipa/default.conf
>
> #File modified by ipa-client-install
>
>
>
> [global]
>
> basedn = dc=myrealm
>
> realm = MYREALM
>
> domain =
mydomain.com <
http://mydomain.com> <
http://mydomain.com>
>
> server =
S1.mydomain.com <
http://S1.mydomain.com>
<
http://S1.mydomain.com>
>
> xmlrpc_uri =
https://S1.mydomain.com/ipa/xml
>
> enable_ra = True
>
>
> Is it possible to benefit from high availability when we use IPA
command
> line ?
> If yes, how ?
In order to do ipa cli fallback you have to use DNS _ldap._tcp SRV
records.
rob
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...