Red Hat Security: Identity Management and Authentication

Instructions

1. Create a topology segment for the domain suffix between replica1 and replica2 using the topology graph.

   1. On workstation, navigate to the IdM web UI at https://idm.lab.example.com. Log in as the admin user with RedHat123^ as the password.

   2. Navigate to IPA Server → Topology → IPA Servers. Note that the domain suffix is present on all servers, however the ca suffix is only present on the idm machine.

   3. In the left navigation bar, click Topology Graph. Note that the topology is not resilient as the loss of the idm machine would disconnect the replica1 and replica2 machines.

   4. Hover over the replica1 node and click the domain suffix. Select replica2 as the other end of the new topology segment. Enter replica-domain-segment as the segment name, and then click Add.

2. On the idm machine, review the existing topology segments for the domain suffix. Delete the domain topology segments between the idm and replica1 machines, and between the replica1 and replica2 machines.

   1. Log in to the idm machine and authenticate to IdM as the admin user.

      [student@workstation ~]$ ssh idm
      [student@idm ~]$ kinit admin
      Password for admin@LAB.EXAMPLE.COM: RedHat123^

   2. List the topology segments for the domain suffix.

      [student@idm ~]$ ipa topologysegment-find domain
      ------------------
      3 segments matched
      ------------------
        Segment name: idm.lab.example.com-to-replica1.lab.example.com
        Left node: idm.lab.example.com
        Right node: replica1.lab.example.com
        Connectivity: both
      
        Segment name: idm.lab.example.com-to-replica2.lab.example.com
        Left node: idm.lab.example.com
        Right node: replica2.lab.example.com
        Connectivity: both
      
        Segment name: replica-domain-segment
        Left node: replica1.lab.example.com
        Right node: replica2.lab.example.com
        Connectivity: both
      ----------------------------
      Number of entries returned 3
      ----------------------------

   3. Delete the domain topology segment between the idm and replica1 machines.

      [student@idm ~]$ ipa topologysegment-del \
        domain idm.lab.example.com-to-replica1.lab.example.com
      -----------------------------------------------------------------
      Deleted segment "idm.lab.example.com-to-replica1.lab.example.com"
      -----------------------------------------------------------------

   4. Delete the domain topology segment between the replica1 and replica2 machines.

      [student@idm ~]$ ipa topologysegment-del \
        domain replica-domain-segment
      ipa: ERROR: Server is unwilling to perform: Removal of Segment disconnects topology.Deletion not allowed.

      Note that IdM prevents you from creating a disconnected topology.

3. Install the IdM healthcheck utility and review the health of the topology.

   1. Install the ipa-healthcheck package on the idm machine.

      [student@idm ~]$ sudo dnf install ipa-healthcheck
      [sudo] password for student: student
      ...output omitted...
      Is this ok [y/N]: y
      ...output omitted...
      Complete!

   2. Review the available health checks. Authenticate to IdM if required.

      [student@idm ~]$ ipa-healthcheck --list-sources
      ...output omitted...
      ipahealthcheck.ipa.topology
         IPATopologyDomainCheck
      ...output omitted...

   3. Run the ipa-healthcheck command with the ipahealthcheck.ipa.topology source. Use the --all option to display all results.

      [student@idm ~]$ ipa-healthcheck --source=ipahealthcheck.ipa.topology --all
      [
        {
          "source": "ipahealthcheck.ipa.topology",
          "check": "IPATopologyDomainCheck",
          "result": "SUCCESS",
          "uuid": "68732542-3b04-46b3-904e-e73a373218fa",
          "when": "20230427095523Z",
          "duration": "0.185348",
          "kw": {
            "suffix": "domain"
          }
        },
        {
          "source": "ipahealthcheck.ipa.topology",
          "check": "IPATopologyDomainCheck",
          "result": "SUCCESS",
          "uuid": "7dadeeab-3a62-4fa8-b58e-75cc533f415a",
          "when": "20230427095523Z",
          "duration": "0.206531",
          "kw": {
            "suffix": "ca"
          }
        }
      ]

      The check succeeds because no servers are disconnected, even though the current topology is not resilient to a failure of the replica2 node.

4. Restore the topology segment between idm and replica1 to create a resilient topology.

   1. Create the topology segment for the domain suffix between the idm and replica1 machines.

      [student@idm ~]$ ipa topologysegment-add domain \
        idm.lab.example.com-to-replica1.lab.example.com \
        --leftnode=idm.lab.example.com \
        --rightnode=replica1.lab.example.com
      ---------------------------------------------------------------
      Added segment "idm.lab.example.com-to-replica1.lab.example.com"
      ---------------------------------------------------------------
        Segment name: idm.lab.example.com-to-replica1.lab.example.com
        Left node: idm.lab.example.com
        Right node: replica1.lab.example.com
        Connectivity: both

   2. Review the topology graph; refresh the view if required. The topology should now be resilient to a single node failure.

5. Identify the IdM master and domain replicas. Verify the domain SRV records for LDAP and Kerberos. Change the replica2 machine to a hidden replica.

   1. On the idm machine, verify the _ldap and _krb SRV records for the domain.

      [student@idm ~]$ dig +short _ldap._tcp.lab.example.com SRV
      0 100 389 replica2.lab.example.com.
      0 100 389 replica1.lab.example.com.
      0 100 389 idm.lab.example.com.
      [student@idm ~]$ dig +short _kerberos._tcp.lab.example.com SRV
      0 100 88 idm.lab.example.com.
      0 100 88 replica2.lab.example.com.
      0 100 88 replica1.lab.example.com.

   2. Verify that the idm machine is the CA renewal master.

      [student@idm ~]$ ipa config-show
      ...output omitted...
        IPA CA renewal master: idm.lab.example.com
      ...output omitted...

   3. Set the state of replica2 to hidden.

      [student@idm ~]$ ipa server-state \
        replica2.lab.example.com --state=hidden
      ---------------------------------------------------
      Changed server state of "replica2.lab.example.com".
      ---------------------------------------------------

   4. Review the SRV records for the domain again.

      [student@idm ~]$ dig +short _ldap._tcp.lab.example.com SRV
      0 100 389 replica1.lab.example.com.
      0 100 389 idm.lab.example.com.
      [student@idm ~]$ dig +short _kerberos._tcp.lab.example.com SRV
      0 100 88 replica1.lab.example.com.
      0 100 88 idm.lab.example.com.

      Note that there are no SRV records for replica2 now that it is hidden.

   5. Set the state of replica2 to enabled.

      [student@idm ~]$ ipa server-state \
        replica2.lab.example.com --state=enabled
      ---------------------------------------------------
      Changed server state of "replica2.lab.example.com".
      ---------------------------------------------------

   6. Log out of the idm machine.

      [student@idm ~]$ logout
      Connection to idm closed.
      [student@workstation ~]$