Dmitry Perets via FreeIPA-users wrote:
I am considering FreeIPA for a multi-site project, to provide both PKI and LDAP services.
So ideally, I would like to have one separate FreeIPA server on each site + one central
And this is what I have in mind:
1. The central FreeIPA server will be my master for LDAP/Kerberos. And each site will
have a replica (so that the users can still authenticate, even if the connectivity to the
central location is broken).
2. As for PKI - I'd prefer to build a hierarchy: central server would be RootCA and
each site would be a separate SubCA (signed by the RootCA).
I tried to implement this, but seems that it is impossible...
I've installed the replica for LDAP/Kerberos successfully, using ipa-replica-install.
But now I cannot add a SubCA to it:
$ sudo ipa-ca-install --external-ca --ca-subject="CN=FreeIPA-SubCA,O=WOOF.NET"
--ca-subject cannot be used when installing a CA replica
So looks like on LDAP replica server I can only install CA replica... not a full
Is there a way to solve this?
* One way, of course, is to install a separate Dogtag CA on each site, and keep CA-less
FreeIPA server just for the LDAP/Kerberos replica...
This is not possible.
All masters in IPA are equal peers with the exception of the optional
services (CA, DNS, etc). So creating a new master via
ipa-replica-install creates an equal peer so there is no concept of
making it somehow subservient in any way.