Make sure the firewalld service is running.

Open the required ports using the firewall-cmd utility. Choose one of the following options:

Reload the firewall-cmd configuration to ensure that the change takes place immediately:

# firewall-cmd --reload

Note that reloading firewalld on a system in production can cause DNS connection time outs. If required, to avoid the risk of time outs and to make the changes persistent on the running system, use the --runtime-to-permanent option of the firewall-cmd command, for example:

# firewall-cmd --runtime-to-permanent --add-port={80/tcp,443/tcp,389/tcp,636/tcp,88/tcp,88/udp,464/tcp,464/udp,53/tcp,53/udp,123/udp}

Enable the idm:DL1 stream:

# yum module enable idm:DL1

Switch to the RPMs delivered through the idm:DL1 stream:

# yum distro-sync

Choose one of the following options, depending on your IdM requirements:

Run the ipa-server-install utility.

# ipa-server-install

The script prompts to configure an integrated DNS service. Enter yes.

Do you want to configure integrated DNS (BIND)? [no]: yes

The script prompts for several required settings and offers recommended default values in brackets.

Enter the passwords for the Directory Server superuser (cn=Directory Manager) and for the Identity Management administration system user account (admin).

Directory Manager password:
IPA admin password:

The script prompts for DNS forwarders.

Do you want to configure DNS forwarders? [yes]:

The script prompts to check if any DNS reverse (PTR) records for the IP addresses associated with the server need to be configured.

Do you want to search for missing reverse zones? [yes]:

If you run the search and missing reverse zones are discovered, the script asks you whether to create the reverse zones along with the PTR records.

Do you want to create reverse zone for IP 192.0.2.1 [yes]:
Please specify the reverse zone name [2.0.192.in-addr.arpa.]:
Using reverse zone(s) 2.0.192.in-addr.arpa.

Enter yes to confirm the server configuration.

Continue to configure the system with these values? [no]: yes

After the installation script completes, add DNS delegation from the parent domain to the Identity Management DNS domain. For example, if the Identity Management DNS domain is ipa.example.com, add a name server (NS) record to the example.com parent domain.

Run the ipa-server-install utility with the options to supply all the required information. The minimum required options for non-interactive installation are:

To install a server with integrated DNS, add also these options:

For example:

# ipa-server-install --realm EXAMPLE.COM --ds-password DM_password --admin-password admin_password --unattended --setup-dns --forwarder 192.0.2.1 --no-reverse

After the installation script completes, add DNS delegation from the parent domain to the Identity Management DNS domain. For example, if the Identity Management DNS domain is ipa.example.com, add a name server (NS) record to the example.com parent domain.

Run the ipa-server-install utility with the --external-ca option.

# ipa-server-install --external-ca

If you are using the Microsoft Certificate Services CA, use also the --external-ca-type option. For details, see the ipa-server-install(1) man page.

The script prompts to configure an integrated DNS service. Enter yes or no. In this procedure, we are installing a server with integrated DNS.

Do you want to configure integrated DNS (BIND)? [no]: yes

The script prompts for several required settings and offers recommended default values in brackets.

Enter the passwords for the Directory Server superuser (cn=Directory Manager) and for the Identity Management administration system user account (admin).

Directory Manager password:
IPA admin password:

The script prompts for DNS forwarders.

Do you want to configure DNS forwarders? [yes]:

The script prompts to check if any DNS reverse (PTR) records for the IP addresses associated with the server need to be configured.

Do you want to search for missing reverse zones? [yes]:

If you run the search and missing reverse zones are discovered, the script asks you whether to create the reverse zones along with the PTR records.

Do you want to create reverse zone for IP 192.0.2.1 [yes]:
Please specify the reverse zone name [2.0.192.in-addr.arpa.]:
Using reverse zone(s) 2.0.192.in-addr.arpa.

Enter yes to confirm the server configuration.

Continue to configure the system with these values? [no]: yes

During the configuration of the Certificate System instance, the utility prints the location of the certificate signing request (CSR): /root/ipa.csr:

...

Configuring certificate server (pki-tomcatd): Estimated time 3 minutes 30 seconds
  [1/8]: creating certificate server user
  [2/8]: configuring certificate server instance
The next step is to get /root/ipa.csr signed by your CA and re-run /sbin/ipa-server-install as:
/sbin/ipa-server-install --external-cert-file=/path/to/signed_certificate --external-cert-file=/path/to/external_ca_certificate

When this happens:

Use the following shell script to unset the *_proxy environmental variables:

# for i in ftp http https; do unset ${i}_proxy; done

Run the pkidestroy utility to remove the unsuccessful CA subsystem installation:

# pkidestroy -s CA -i pki-tomcat; rm -rf /var/log/pki/pki-tomcat /etc/sysconfig/pki-tomcat /etc/sysconfig/pki/tomcat/pki-tomcat /var/lib/pki/pki-tomcat /etc/pki/pki-tomcat /root/ipa.csr

Remove the failed Identity Management server installation:

# ipa-server-install --uninstall

Run the ipa-server-install utility and provide all the required certificates. For example:

[root@server ~]# ipa-server-install \
    --http-cert-file /tmp/server.crt \
    --http-cert-file /tmp/server.key \
    --http-pin secret \
    --dirsrv-cert-file /tmp/server.crt \
    --dirsrv-cert-file /tmp/server.key \
    --dirsrv-pin secret \
    --ca-cert-file ca.crt

See Section 4.1, “Certificates required to install an Identity Management server without a CA” for details on the provided certificates.

The script prompts to configure an integrated DNS service. Enter yes or no. In this procedure, we are installing a server with integrated DNS.

Do you want to configure integrated DNS (BIND)? [no]: yes

The script prompts for several required settings and offers recommended default values in brackets.

Enter the passwords for the Directory Server superuser (cn=Directory Manager) and for the Identity Management administration system user account (admin).

Directory Manager password:
IPA admin password:

The script prompts for DNS forwarders.

Do you want to configure DNS forwarders? [yes]:

The script prompts to check if any DNS reverse (PTR) records for the IP addresses associated with the server need to be configured.

Do you want to search for missing reverse zones? [yes]:

If you run the search and missing reverse zones are discovered, the script asks you whether to create the reverse zones along with the PTR records.

Do you want to create reverse zone for IP 192.0.2.1 [yes]:
Please specify the reverse zone name [2.0.192.in-addr.arpa.]:
Using reverse zone(s) 2.0.192.in-addr.arpa.

Enter yes to confirm the server configuration.

Continue to configure the system with these values? [no]: yes

After the installation script completes, add DNS delegation from the parent domain to the Identity Management DNS domain. For example, if the Identity Management DNS domain is ipa.example.com, add a name server (NS) record to the example.com parent domain.

Run the ipa-server-install utility.

# ipa-server-install

The script prompts to configure an integrated DNS service. Press Enter to select the default no option.

Do you want to configure integrated DNS (BIND)? [no]:

The script prompts for several required settings and offers recommended default values in brackets.

Enter the passwords for the Directory Server superuser (cn=Directory Manager) and for the Identity Management administration system user account (admin).

Directory Manager password:
IPA admin password:

Enter yes to confirm the server configuration.

Continue to configure the system with these values? [no]: yes

Run the ipa-server-install utility with the options to supply all the required information. The minimum required options for non-interactive installation are:

For example:

# ipa-server-install --realm EXAMPLE.COM --ds-password DM_password --admin-password admin_password --unattended

Run the ipa-client-install utility on the system that you want to configure as an Identity Management client.

# ipa-client-install

Add the --enable-dns-updates option to update the DNS records with the IP address of the client system if either of the following conditions applies:

# ipa-client-install --enable-dns-updates

Enabling DNS updates is useful if your client:

The installation script attempts to obtain all the required settings, such as DNS records, automatically.

The script prompts for a user whose identity will be used to enroll the client. This could be, for example, a hostadmin user with the Enrollment Administrator role:

User authorized to enroll computers: hostadmin
Password for hostadmin@EXAMPLE.COM:

The installation script now configures the client. Wait for the operation to complete.

Client configuration complete.

On a server in the domain, add the future client system as an Identity Management host. Use the --random option with the ipa host-add command to generate a one-time random password for the enrollment.

$ ipa host-add client.example.com --random
 --------------------------------------------------
 Added host "client.example.com"
 --------------------------------------------------
  Host name: client.example.com
  Random password: W5YpARl=7M.n
  Password: True
  Keytab: False
  Managed by: server.example.com

Run the ipa-client-install utility on the system that you want to configure as an Identity Management client. Use the --password option to provide the one-time random password. Because the password often contains special characters, enclose it in single quotes (').

# ipa-client-install

Add the --enable-dns-updates option to update the DNS records with the IP address of the client system if either of the following conditions applies:

# ipa-client-install --password 'W5YpARl=7M.n' --enable-dns-updates

Enabling DNS updates is useful if your client:

The installation script attempts to obtain all the required settings, such as DNS records, automatically.

The installation script now configures the client. Wait for the operation to complete.

Client configuration complete.

Pre-create the host entry on the Identity Management server, and set a temporary password for the entry:

$ ipa host-add client.example.com --password=secret

The password is used by Kickstart to authenticate during the client installation and expires after the first authentication attempt. After the client is successfully installed, it authenticates using its keytab.

Run the ipa-client-install --force-join command on the client machine:

# ipa-client-install --force-join

The script prompts for a user whose identity will be used to re-enroll the client. This could be, for example, a hostadmin user with the Enrollment Administrator role:

User authorized to enroll computers: hostadmin
Password for hostadmin@EXAMPLE.COM:

Use the ipa-client-install utility to re-enroll the client, and specify the keytab location with the --keytab option:

# ipa-client-install --keytab /etc/krb5.keytab

Run the ipa-client-install --uninstall command:

# ipa-client-install --uninstall

Remove the DNS entries for the client host manually from the server:

# ipa dnsrecord-del
Record name: old-client-name
Zone name: idm.example.com
No option to delete specific record provided.
Delete all? Yes/No (default No): yes
------------------------
Deleted record "old-client-name"

Run the ipa-client-install --uninstall command:

# ipa-client-install --uninstall

Remove the DNS entries for the client host manually from the server:

# ipa dnsrecord-del
Record name: old-client-name
Zone name: idm.example.com
No option to delete specific record provided.
Delete all? Yes/No (default No): yes
------------------------
Deleted record "old-client-name"

For each identified keytab other than /etc/krb5.keytab, remove the old principals:

[root@client ~]# ipa-rmkeytab -k /path/to/keytab -r EXAMPLE.COM

See TBD <removing-keytabs>>.

On an IdM server, remove the host entry. This removes all services and revokes all certificates issued for that host:

[root@server ~]# ipa host-del client.example.com

On the Identity Management server, add a new keytab for every service identified in Section 13.1, “Prerequisites”.

[root@server ~]# ipa service-add service_name/new-client-name

Generate certificates for services that had a certificate assigned in Section 13.1, “Prerequisites”. You can do this:

Run ipa-replica-install with these options:

For example, to set up a replica with an integrated DNS server that forwards all DNS requests not managed by the IdM servers to the DNS server running on IP 192.0.2.1:

# ipa-replica-install --setup-dns --forwarder 192.0.2.1

Run ipa-replica-install with the --setup-ca option.

# ipa-replica-install --setup-ca

Create a user on the new replica:

[admin@new_replica ~]$ ipa user-add test_user

Make sure the user is visible on another replica:

[admin@another_replica ~]$ ipa user-show test_user

Update the ipa-* packages to their latest version:

[root@rhel7 ~]# yum update ipa-*

Update the ipa-* packages to their latest version:

[root@rhel8 ~]# yum update ipa-*

List which server roles are present in your RHEL 7 environment:

[root@rhel7 ~]# ipa server-role-find --status enabled
----------------------
4 server roles matched
----------------------
  Server name: rhel7.example.com
  Role name: CA server
  Role status: enabled

  Server name: replica7.example.com
  Role name: DNS server
  Role status: enabled

  Server name: rhel7.example.com
  Role name: DNS server
  Role status: enabled

  Server name: rhel7.example.com
  Role name: NTP server
  Role status: enabled
[... output truncated ...]

Install the IdM server on rhel8.example.com as a replica of the IdM RHEL 7 server, including all the server roles present on your rhel7.example.com. To install all the roles from the example above, use these options with the ipa-replica-install command:

You do not need to specify the RHEL 7 IdM server because if DNS is working correctly, rhel8.example.com will find it using DNS autodiscovery.

After the installation completes, verify that the Identity Management services are running on rhel8.example.com:

[root@rhel8 ~]# ipactl status
Directory Service: RUNNING
[... output truncated ...]
ipa: INFO: The ipactl command was successful

Verify that rhel7.example.com and rhel8.example.com CAs are both configured as master servers:

[root@rhel8 ~]$ kinit admin
[root@rhel8 ~]$ ipa-csreplica-manage list
rhel7.example.com: master
rhel8.example.com: master

Optionally, to display details about the replication agreement between rhel7.example.com and rhel8.example.com:

[root@rhel8 ~]# ipa-csreplica-manage list --verbose rhel8.example.com
Directory Manager password:

rhel7.example.com
last init status: None
last init ended: 1970-01-01 00:00:00+00:00
last update status: Error (0) Replica acquired successfully: Incremental update succeeded
last update ended: 2019-02-13 13:55:13+00:00

Stop the CA service.

[root@rhel7 ~]# systemctl stop pki-tomcatd@pki-tomcat.service

Disable CRL generation on rhel7.example.com. Edit the /etc/pki/pki-tomcat/ca/CS.cfg file, setting the values of the ca.crl.MasterCRL.enableCRLCache and ca.crl.MasterCRL.enableCRLUpdates parameters to false.

ca.crl.MasterCRL.enableCRLCache=false
ca.crl.MasterCRL.enableCRLUpdates=false

Start the CA service.

[root@rhel7 ~]# systemctl start pki-tomcatd@pki-tomcat.service

Configure Apache to redirect CRL requests to the new master. Open the /etc/httpd/conf.d/ipa-pki-proxy.conf file and uncomment the RewriteRule argument, replacing the server host name with the rhel8.example.com host name in the server URL:

# Only enable this on servers that are not generating a CRL
RewriteRule ^/ipa/crl/MasterCRL.bin https://rhel8.example.com/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC]

Restart Apache.

[root@rhel7 ~]# systemctl restart httpd.service

Stop the CA service:

[root@rhel8 ~]# systemctl stop pki-tomcatd@pki-tomcat.service

Enable CRL generation on the server. Edit the /etc/pki/pki-tomcat/ca/CS.cfg file, setting the values of the ca.crl.MasterCRL.enableCRLCache and ca.crl.MasterCRL.enableCRLUpdates parameters to true:

ca.crl.MasterCRL.enableCRLCache=true
ca.crl.MasterCRL.enableCRLUpdates=true

Start the CA service:

[root@rhel8 ~]# systemctl start pki-tomcatd@pki-tomcat.service

Configure Apache to disable redirecting CRL requests. Open the /etc/httpd/conf.d/ipa-pki-proxy.conf file and comment out the RewriteRule argument:

# Only enable this on servers that are not generating a CRL
#RewriteRule ^/ipa/crl/MasterCRL.bin https://rhel7.example.com/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC]

Before, all CRL requests were routed to the previous CA master. Now, this server will respond to CRL requests.

Restart Apache:

[root@rhel8 ~]# systemctl restart httpd.service

Make sure that all, even the latest data is correctly migrated from rhel7.example.com to rhel8.example.com. For example:

Stop all service on rhel7.example.com to force domain discovery to the new rhel8.example.com server.

[root@rhel7 ~]# ipactl stop
Stopping CA Service
Stopping pki-ca:                                           [  OK  ]
Stopping HTTP Service
Stopping httpd:                                            [  OK  ]
Stopping MEMCACHE Service
Stopping ipa_memcached:                                    [  OK  ]
Stopping DNS Service
Stopping named: .                                          [  OK  ]
Stopping KPASSWD Service
Stopping Kerberos 5 Admin Server:                          [  OK  ]
Stopping KDC Service
Stopping Kerberos 5 KDC:                                   [  OK  ]
Stopping Directory Service
Shutting down dirsrv:
    EXAMPLE-COM...                                         [  OK  ]
    PKI-IPA...                                             [  OK  ]

After this, the ipa utility will contact the new server through a remote procedure call (RPC).