You must plan the size and distribution of your IdM topology before installing your first IdM server. Red Hat recommends installing multiple, replicated servers for performance, redundancy, and balanced data distribution.

IdM often stores information in cache, so RAM sizing is important. You can estimate your IdM server's minimum RAM requirements with the following suggestions:

The size of a user or host entry with a configured certificate for Kerberos authentication is about 10 KB. For large deployments, consider increasing the available memory because much of the data is stored in the cache.

Always install an IdM server on a clean system without any existing Apache, Directory Server, DNS, or Kerberos services. When you first install a new IdM server, the installer backs up system files and overwrites them. This backup is stored in the /var/lib/ipa/sysrestore/ directory. These files are restored when IdM is uninstalled at the end of the system's lifecycle.

The Name Service Cache Daemon (NSCD) used in earlier identity management solutions is replaced by SSSD in IdM. IdM uses SSSD to perform caching, and having both services available simultaneously might cause unforeseen problems. These two daemons are mutually exclusive; ensure that NSCD is disabled before performing the installation.

IdM requires that IPv6 is enabled at the kernel level. You do not have to use IPv6 addresses or have IPv6 enabled on the network. IPv6 is enabled by default on Red Hat Enterprise Linux 9. When IPv6 protocol support is fully disabled at the kernel level, IdM cannot operate certain important plug-ins in its LDAP server. These plug-ins are required for interoperability with Active Directory.

Your IdM host must have a valid DNS client configuration. The DNS server must resolve the IdM server's fully qualified domain name (FQDN) and its reverse resolution, because most IdM domain functions depend on DNS records, including LDAP directory services, Kerberos, and Active Directory integration.

Consider also whether you are going to enable Federal Information Processing Standard (FIPS) mode on the IdM server. If FIPS is enabled, the installer configures IdM to only use cipher suites that are compliant with FIPS 140-3. For an IdM ecosystem to be FIPS-compliant, all the IdM replicas must have FIPS mode enabled. When FIPS mode is enabled clients are not required to enable FIPS to interact with IdM however Red Hat recommends that you enable FIPS on the clients, especially if these clients might be promoted to replicas.

Ensure that the host server name is a fully qualified domain name (FQDN). To verify your server's hostname, use the hostname command:

[user@idm ~]$ hostname
idm.example.com

Verify the server's IP address by running the ip addr show command. Verify the forward and reverse DNS configuration:

[user@idm ~]$ dig idm.example.com
...output omitted...
;; ANSWER SECTION:
idm.example.com.	3600	IN	A	172.20.150.8
...output omitted...

[user@idm ~]$ dig -x 172.20.150.8
...output omitted...
;; ANSWER SECTION:
8.150.20.172.in-addr.arpa. 3600	IN	PTR	idm.example.com.
...output omitted...

IdM uses a range of ports for communication with its services.

All the ports required by an IdM server are present in the firewalld service definition. To open those ports, you can use firewall-cmd command with the --add-service option. For example, freeipa-ldap for IdM with LDAP, or freeipa-ldaps for IdM with LDAPS, or both. Optionally, the firewall-cmd --runtime-to-permanent command saves the active runtime configuration and overwrites the permanent rules.

[root@idm ~]# firewall-cmd --add-service=freeipa-ldap
success
[root@idm ~]# firewall-cmd --add-service=freeipa-ldaps
success
[root@idm ~]# firewall-cmd --runtime-to-permanent
success

The installation of DNS and CA services can be integrated or external. You can have integrated DNS and external CA and vice versa. The NTP service, however, must be provided externally.

A functional DNS configuration is required for nearly for all Identity Management domain functions. IdM can manage its own DNS or use an existing DNS server. When using an integrated DNS server, most of the DNS record maintenance is automated. You can configure global forwarders during the installation of the IdM server for a stable external internet connection. Global forwarders are also useful for trusts with Active Directory.

During installation, when you choose an integrated DNS, IdM can either prompt for the required information, or you can pass the DNS information to the installer for automatic or unattended setup.

Some DNS limitations need to be considered before starting the IdM installation. The integrated DNS server provided by IdM is not designed to be used as a general purpose DNS server. Its main function is to support IdM deployment and maintenance. It does not support advanced DNS features.

Red Hat recommends using the integrated DNS for basic usage within the IdM deployment. An IdM deployment with integrated DNS enables the automation of some DNS record management using native IdM tools.

Kerberos, the mechanism for authentication in IdM, relies on time stamps; the client and server clocks must be synchronized within a certain margin. If the system time of an IdM client differs from the system time of the Key Distribution Center (KDC) by more than five minutes, then Kerberos authentication fails. Certificate, ticket, and password expiration, and account lockouts also rely on time and date synchronization to function.

To keep time synchronized centrally between IdM servers and clients, IdM relies on the chronyd Network Time Protocol (NTP) software. NTP is used to synchronize clocks over the network. A central server acts as an authoritative clock, and all clients that reference that NTP server synchronize their time to match.

The IdM installer searches for _ntp._udp DNS service (SRV) records that point to the NTP server in your network and configures the chrony service by using that address. If you do not have an _ntp._udp SRV record configured, then the chronyd service uses its default configuration.

Use the dig command to verify that you have the correct DNS configuration.

[user@idm ~]$ dig +short -t SRV _ntp._udp.example.com
0 100 123 ntpserver.example.com.

If this search does not return a record, then add an _ntp._udp SRV record to your DNS zone that points to your NTP time server and port 123, which is the NTP default.

The integrated IdM certificate authority (CA) can be used to create all required certificates and keytabs used by users or hosts in a domain.

By default, most of the IdM servers are installed with the integrated certificate system governed by the integrated IdM certificate authority (CA). Within the IdM domain the CA uses a signing certificate to create and sign all hosts and user certificates. On the IdM host, server certificates are required for the IdM internal domain services to work properly. For example, the LDAP server and Apache server (for the Identity Management web UI) require server certificates for establishing secure connections with each other.

For the signing certificate to work, the CA certificate has to be signed by the CA that issued it. There are two ways that a CA can sign the certificate:

You can configure the installation of IdM without a CA. If you do not use a CA, you have to manually create, renew, and upload certificates used in the IdM domain.

Defining the CA requirements is crucial before the beginning of the installation process. IdM does not support changing the CA configuration after creating the domain.

The IdM server installation process involves several security considerations: the IdM installation requires the file mode creation be set to 0022 for the root user. You can set this temporarily and restore it to its original value when the installation is complete. For Java and the Java classes, ensure that they are not blocked by fapolicyd rules.

You can use the ipa-server-install command to install the IdM server. You can provide the options to customize the installation either with the interactive or unattended installation.

The following is a list of the most common options to customize the installation:

Options for internal DNS configuration:

Options for NTP and CA configuration:

Before you begin the IdM server installation, install the ipa-server and ipa-server-dns packages. The ipa-server package installs dependencies such as krb5-server, 389-ds-base, and IdM command-line tools and web console.

[root@host ~]# dnf install ipa-server ipa-server-dns
...output omitted...
Complete!

The ipa-server-install command creates and configures new IdM instances. By default, it prompts for options but you can also use command-line arguments.

The interactive installation prompts you for IdM configuration information.

[root@host ~]# ipa-server-install
...output omitted...

Server host name [host.lab.example.com]: host.lab.example.com

Warning: skipping DNS resolution of host host.lab.example.com
The domain name has been determined based on the host name.

Please confirm the domain name [lab.example.com]: lab.example.com

The kerberos protocol requires a Realm name to be defined.
This is typically the domain name converted to uppercase.

Please provide a realm name [LAB.EXAMPLE.COM]: LAB.EXAMPLE.COM
Certain directory server operations require an administrative user.
This user is referred to as the Directory Manager and has full access
to the Directory for system management tasks and will be added to the
instance of directory server created for IPA.
The password must be at least 8 characters long.

Directory Manager password: RedHat123^
Password (confirm): RedHat123^

The IPA server requires an administrative user, named 'admin'.
This user is a regular system account used for IPA server administration.

IPA admin password: RedHat123^
Password (confirm): RedHat123^

...output omitted...

The IPA Master Server will be configured with:
Hostname:       host.lab.example.com
IP address(es): 172.25.250.8
Domain name:    lab.example.com
Realm name:     LAB.EXAMPLE.COM

The CA will be configured with:
Subject DN:   CN=Certificate Authority,O=LAB.EXAMPLE.COM
Subject base: O=LAB.EXAMPLE.COM
Chaining:     self-signed

BIND DNS server will be configured to serve IPA domain with:
Forwarders:       172.25.250.254, 8.8.8.8
Forward policy:   only
Reverse zone(s):  No reverse zone

Continue to configure the system with these values? [no]: yes
...output omitted...

The installation process takes a few minutes to complete. The ipa-server-install command creates the /var/log/ipaserver-install.log file, which you can review if the installation fails.

An unattended installation is suited to scripting and automation. Use the --unattended option and include the desired options for the IdM instance.

[root@host ~]# ipa-server-install --realm LAB.EXAMPLE.COM \
  --ds-password RedHat123^ \
  --admin-password RedHat123^  --ntp-server 172.25.254.254 \
  --unattended
...output omitted...

After the installation is complete, validate the Kerberos, DNS, and NTP services, and also verify that you can log in successfully to the Identity Management web UI.

Both interactive and unattended installations create an instance of an IdM domain and configure all the required services and policies:

Depending on your needs for the IdM domain, the setup process can be minimal or granular, by providing configuration of the IdM services as command-line arguments to the ipa-server-install command.