How to promote replicated master server in freeIPA, if lost first master?

[Anubhav Gupta]

I have replicated multi-master environment of freeIPA server. Suppose I have follwoing
master server of freeIPA-

First Master - ipa-server.xyz.com

Replicated master - ipa-replica.xyz.com

My all application like Jenkins, GitLab etc use ipa-server.xyz.com to authenticate. Now I
lost my first master server. How can i use my replicated master server in place of first
one ?

[Florence Renaud]

Hi,
I'm moving the thread to freeipa-users mailing list as it's a better place
for this conversation.

The chapter Adjusting IdM clients during recovery
<https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...
of IdM guide Performing disaster recovery with Identity Management
<https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...
explains the required steps when a server is removed from the topology.
You may also need to update the configuration of your applications if they
hard-coded the server name.

If the first master was the CA renewal master / CRL generation master, you
also need to move these functions to the replica, using the steps from
Assigning
the CA renewal server role to the RHEL 8 IdM server
<https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...
and Starting CRL generation on the new RHEL 8 IdM CA server
<https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/...
.

HTH,
flo

On Sat, May 15, 2021 at 6:43 PM Anubhav Gupta via FreeIPA-devel <
freeipa-devel(a)lists.fedorahosted.org&gt; wrote:

>  I have replicated multi-master environment of freeIPA server. Suppose
> I
>  have follwoing master server of freeIPA-
>
>  First Master - ipa-server.xyz.com
>
>  Replicated master - ipa-replica.xyz.com
>
>  My all application like Jenkins, GitLab etc use ipa-server.xyz.com to
>  authenticate. Now I lost my first master server. How can i use my
>  replicated master server in place of first one ?
>  _______________________________________________
>  FreeIPA-devel mailing list -- freeipa-devel(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-devel-leave(a)lists.fedorahosted.org
>  Fedora Code of Conduct:
>  https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
>  https://lists.fedorahosted.org/archives/list/[e-mail]...
>  Do not reply to spam on the list, report it:
>  https://pagure.io/fedora-infrastructure
>