Bug #17327
open
Unable to use multiple FreeIPA servers to enroll to REALM
Description
Cloned from https://bugzilla.redhat.com/show_bug.cgi?id=1349487
Description of problem:
We have an IDM solution with two IDM-servers.
When we are provisioning we are using satellite -> capsule -> IDM. It works.
The question is how to modify the provisioning so it works when one IDM server is down.
This is the default config in the /etc/ipa/default.conf file on capsule, only the specified IDM server in this file will be used to enroll the client into the REALM:
[global]
verbose = 9
basedn = dc=domain,dc=domain,dc=com
realm = REALM
domain = domain
server = idmserver1.domain.com
host = capsule.domain.com
xmlrpc_uri = https://idmserver1.domain.comipa/xml
enable_ra = True
Version-Release number of selected component (if applicable):
Satellite 6.1.9
How reproducible:
100%
Steps to Reproduce:
1. Setup 2 IDM server with full replication
2. Configure capsule for REALM external authentication
3. Provision with the specified IDM down from the /etc/ipa/default.conf on the capsule
Actual results:
Failed to create realm entry: ERF12-5287 [ProxyAPI::ProxyException]: Unable to create realm entry
Expected results:
To use the second IDM server for the enrollment into the REALM
Additional info:
Updated by Stephen Benjamin over 7 years ago
- Subject changed from Unable to use multiple IDM servers to enroll to REALM to Unable to use multiple FreeIPA servers to enroll to REALM
Updated by Dominic Cleal over 7 years ago
- Category set to Realm
Should this be filed in the smart proxy if it's meant to fall back to a secondary URL? Or are you implying it should fall back to a different smart proxy?
Updated by Stephen Benjamin almost 7 years ago
- Category changed from Realm to Smart Proxy
No, on the smart proxy side. Do you want this in the smart proxies category? Realm seemed more germane.
Anyway, the smart proxy should maybe try to use SRV DNS lookups to dynamically find the IPA server, as an option. The ipa.conf only gives one URL, and that freeipa server could be down.
Updated by Dominic Cleal almost 7 years ago
- Project changed from Foreman to Smart Proxy
- Category changed from Smart Proxy to Realm