[Freeipa-users] Freeipa replica info to clents: guidance

[Matrix]

Hi, Rakesh


Try 'ipa-client-install' with this option '--fixed-primary'. with it, '_srv_' will disappeared 


From man page:
       --fixed-primary
              Configure  SSSD  to use a fixed server as the primary IPA server. The default is to
              use DNS SRV records to determine the primary server to use and  fall  back  to  the
              server  the client is enrolled with. When used in conjunction with --server then no
              _srv_ value is set in the ipa_server option in sssd.conf.



Matrix
------------------ Original ------------------
From:  "Rakesh Rajasekharan";<rakesh.rajasekharan at gmail.com>;
Date:  Sat, Jan 21, 2017 10:09 PM
To:  "Matrix"<matrix.zj at qq.com>; 
Cc:  "freeipa-users"<freeipa-users at redhat.com>; 
Subject:  Re: [Freeipa-users] Freeipa replica info to clents: guidance



Thanks Matrix.. for the inputs..

> Firstly, '_srv_' means clients will find out which servers will be  connected with by dns srv records. In your explanation, DNS did not  configure in your env.


After running the ipa-client, the _srv_ was automatically added . The configs options I passed for configuring the host as a IPA client is

ipa-client-install --domain=mydomain.com --server=ipa-master-int.mydomain.com --realm=MYDOMAIN.COM -p admin --password=mypass --mkhomedir --hostname=first-client-int.mydomain.com --no-ssh --no-sshd -N -f -U



While configuring  IPA server , I did not pass the setup-dns options.( that avoids setting up the dns server I assume )


ipa-server-install -r 'MYDOMAIN.COM' -n 'mydomain.com' -p mypass -P mypass -a mypass --hostname=ipa-master-int.mydomain.com -N -U


So, I did not explicitly specify the _srv_ options. However, this has been working fine till now.



> Secondly, 'replica' key words ? I can not find it from man pages of sssd-ipa. is it really working fine? 

sorry that was a typo from my side .

Its actually 
ipa_server = _srv_, ipa-master-mydomain.com, ipa-replica-mydomain.com.


> So, I suggested to configure it in this way:
> ipa_server = <ipa1>
> ipa_backup_server = <ipa2>


> For another half clients, 
> ipa_server = <ipa2>

> ipa_backup_server = <ipa1>


I will try this out.. probably I can safely leave out _srv_



Thanks

Rakesh




On Sat, Jan 21, 2017 at 6:10 PM, Matrix <matrix.zj at qq.com> wrote:
For my understanding, there is something wrong with your configuration


>> ipa_server = _srv_, ipa-master-mydomain.com, repilca ipa-replica-mydomain.com


Firstly, '_srv_' means clients will find out which servers will be connected with by dns srv records. In your explanation, DNS did not configure in your env.


Secondly, 'replica' key words ? I can not find it from man pages of sssd-ipa. is it really working fine? 


>>Also, can I define priority based on the order in which the IPA servers are defined in 

>>ipa_server = _srv_ ,<ipa1>,<ipa2>


your understanding is correct. server priority is based on sequence in conf file. There is a problem for this configuration. Once 'ipa1' failed, all id lookup/authentication will be happened with 'ipa2'. Even 'ipa1' was back, all clients will be sticky on 'ipa2'


So, I suggested to configure it in this way:
ipa_server = <ipa1>
ipa_backup_server = <ipa2>


For another half clients, 
ipa_server = <ipa2>

ipa_backup_server = <ipa1>


Matrix


------------------ Original ------------------
From:  "Rakesh Rajasekharan";<rakesh.rajasekharan at gmail.com>;
Date:  Sat, Jan 21, 2017 08:25 PM
To:  "freeipa-users"<freeipa-users at redhat.com>; 

Subject:  [Freeipa-users] Freeipa replica info to clents: guidance



Hi,


My Freeipa setup is on AWS ec2 instances and has been working fine with just one master for a while now.


I am now trying to setup replica servers which, I was able to and the replication between both masters go fine.


So, I have a master serer ipa-master-mydomain.com and repilca ipa-replica-mydomain.com



I am not using DNS and rely on AWS for DNS resolution instead.


My question is , how do I tell clients about the new replica server .


I tried an entry in the sssd.conf domain section of the clients


id_provider = ipa
auth_provider = ipa
ipa_server = _srv_, ipa-master-mydomain.com, repilca ipa-replica-mydomain.com



This approach works fine and clients reach out to the replica as a failover. However, wanted to verify if this is the correct way.


Also, can I define priority based on the order in which the IPA servers are defined in 

ipa_server = _srv_ ,<ipa1>,<ipa2>


If the above assumption is right, I could have half of my clients connect to master always and rest to the replica that way balancing the load.



Thanks

Rakesh
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20170121/26cfbbc7/attachment.htm>