Adding a second IPA server

A second IPA server (replica) is a multi-master peer: directory, KDC, CA and DNS replicate both ways, and the domain keeps working when either server is down. The console currently runs only on the first server; the replica is plain FreeIPA. The ipa CLI works on both.

Replicas are not installed by the playbook; use FreeIPA's own ipa-replica-install. It is stricter about a clean target than ipa-server-install, so do not skip the checks.

Pre-flight (on the new host)

hostname -f                          # FQDN
getent hosts $(hostname -f)          # first answer must be the real IPv4, never ::1 or 127.0.0.1
grep '^hosts' /etc/nsswitch.conf     # should be hosts: files dns, without myhostname

rpm -q mod_ssl ipa-server ipa-server-dns sssd-common idm-pki-base bind-dyndb-ldap
rpm -Va --nofiledigest --nomtime --nomode 2>/dev/null | grep '^missing' || echo "no missing files"
ls -l /etc/krb5.conf.d/crypto-policies      # must exist, symlink to /etc/crypto-policies/back-ends/krb5.config

chronyc sources                      # within 5 minutes of the first server
ss -lntp | grep -E ':(389|636|8443|8080) ' || echo "ports clear"

Install

On the new host, enrol as a client first, then promote:

ipa-client-install --domain=<domain> --realm=<REALM> \
  --server=<first server FQDN> --principal admin -U -p admin -w '<admin password>'

kinit admin
ipa-replica-install --setup-ca --setup-dns --forwarder=<the first server's forwarder> -U

Find the first server's forwarder with ipa dnsconfig-show (global); if empty, ipa dnsserver-show <first server FQDN> (per server). Use --no-forwarders when there is none.

-p admin -w in step one only covers enrolment; step two in -U mode needs a valid admin ticket, hence the kinit admin in between (or add --principal admin --admin-password to step two).

10 to 15 minutes: directory 40 steps → KDC → dirsrv TLS → httpd 21 steps → CA 33 steps (about 3 minutes) → DNS 9 steps → DNSSEC key sync.

Output you can ignore

After install

# new host
ipactl status                              # 9 (no adtrust) or 11 services RUNNING
getcert list | grep -c MONITORING          # 8 or 9

# first server
ipa server-find                            # two servers
ipa topologysegment-find domain            # one segment, Connectivity: both
dig +short <new host FQDN>                 # A record present

Test replication with real data. Neither topologysegment nor ipa-replica-manage list proves data is flowing:

# first server
ipa user-add repltest --first=a --last=b
# new host, after 15 seconds
ipa user-show repltest
# repeat in the other direction, then delete on the first server
ipa user-del repltest

The reverse zone the installer warned about can be created on either server and replicates:

ipa dnszone-add <reverse>.in-addr.arpa.
ipa dnsrecord-add <reverse>.in-addr.arpa. <last octet> --ptr-rec=<new host FQDN>.

Run dig -x first to confirm no other DNS server is authoritative for that subnet.

Replication not flowing

Install succeeded but user-add does not replicate. Read the agreement status on both sides:

ldapsearch -QY GSSAPI -o ldif-wrap=no -b "cn=mapping tree,cn=config" \
  "(objectclass=nsds5replicationagreement)" cn nsds5replicaLastUpdateStatusJSON | grep -E "^cn:|Status"

dsconf binds as Directory Manager over LDAPI automatically when run as root; no password needed.

To see which side is at fault, bind from the new host with a full Kerberos trace:

KRB5_TRACE=/dev/stdout ldapwhoami -Y GSSAPI -H ldap://<first server FQDN> 2>&1 | grep -E "tkt=|Invalid"

tkt=camellia256-cts-cmac is the first row of the table above.

Clean up and retry

A failed ipa-replica-install leaves residue on both servers. Clean both:

# new host
ipa-server-install --uninstall -U --ignore-topology-disconnect
dsctl slapd-<REALM> remove --do-it 2>/dev/null
rm -rf /etc/dirsrv/slapd-<REALM> /etc/pki/pki-tomcat /var/lib/pki/pki-tomcat /var/log/pki/pki-tomcat /etc/ipa/default.conf
rm -f /var/lib/ipa/sysrestore/sysrestore.state /var/lib/ipa/sysrestore/sysrestore.index
getcert list | grep -o "Request ID '[0-9]*'"     # getcert stop-tracking -i <id> for each
systemctl stop krb5kdc kadmin
sed -i 's/^hosts:.*/hosts:      files dns/' /etc/nsswitch.conf     # uninstall restored it

# first server
ipa server-del <new host FQDN> --force --ignore-topology-disconnect --ignore-last-of-role
ipa host-del <new host FQDN>
ipa server-find; ipa topologysegment-find domain      # only the first server, 0 segments

ipa-server-install --uninstall printing IPA server is not configured is normal; it still removes the server entry on the first server. If it aborts with Replication topology is disconnected, add --ignore-topology-disconnect.

With both sides clean, start again from pre-flight. If the KDC was restarted mid-way, remember it depends on the directory: systemctl restart krb5kdc kadmin dirsrv@... in one command starts the KDC before LDAP is ready. Use ipactl restart instead.