On 09/27/2013 03:08 PM, Mohan Cheema wrote:
-----Original Message-----
From: Martin Kosek [mailto:mko...@redhat.com]
Sent: Friday, September 27, 2013 9:22 AM
To: Mohan Cheema
Cc: freeipa-users@redhat.com
Subject: Re: [Freeipa-users] FreeIPA Master Slave Setup Client

On 09/27/2013 06:45 AM, Mohan Cheema wrote:

We have setup FreeIPA within our environment the setup is master
slave. We want
to know how we can configure clients to look to slave incase master
server is
no available to authenticate the user.



*Mohan Cheema*

FreeIPA replicas are master-master replicas by default. Can you please
elaborate how did you create the slave server?

About client configuration - can you use autodiscovery with DNS SRV
(the same as IPA uses for autodiscovery). You would just need to create
records for your slave server, with priority lower than the priority of
server. Client should then look at the slave only if the master is not


First installed the master server. Than we have used following command on

ipa-replica-prepare kdc.domain.com

Transferred it to second server and ran following command

ipa-replica-install /var/lib/ipa/replica-info-kdc.domain.com

Ah, ok - this is standard master-master replication in FreeIPA. I.e. when you a modification in any of these servers, it is replicated to the other one too.

Haven't really checked if I update the second master is updated.

Is is.

About client configuration I cannot use the DNS server as the hosting is on
Amazon Web Service(AWS) and don't want to add another instance as we are
tight budget.
Cannot have DNS server on any of the server as this setup is for compliance.


Ok. If you are not using DNS, you could use a fixed list of IPA servers FQDNs when you are installing client. At least SSSD should use the first one as the primary point of contact and connect to the second one only if the first one is down.

# ipa-client-install --server first.ipa.server --server second.ipa.server --domain ipa.server --fixed-primary


Freeipa-users mailing list

Reply via email to