Hello,

I've setup two ipa-servers on RHEL 7 that are up an running. Replication is 
also working.

#ipa-replica-manage list
Directory Manager password: 

s-fcbg-ipa2.ipa.cornelsen.de: master
s-onli-ipa1.ipa.cornelsen.de: master

Both servers running ipa-server-4.2 :

rpm -qa | grep ipa-server
ipa-server-dns-4.2.0-15.el7_2.17.x86_64
ipa-server-4.2.0-15.el7_2.17.x86_64

I have also a client installed running also version 4.2

ipa-client-4.2.0-15.el7_2.17.x86_64

The client and the first server are in the same subnet, while server 2 is in a 
different subnet. 
All ports that are required are open for server 1 to server 2 and also for the 
client to server two.

I have an subdomain ipa.cornelsen.de that is managed by both ipa-servers. the 
subdomain is forwarded by out general dns-server to both ipa-servers.

If I switch server 1 off I would expect that the client is using the second 
server to check access and sudo rights, but that's not the case. If I create a 
new user on the ipa-server and then switch off the first server, the user 
cannot login to the client. If I switch on server 1 again, the user can login. 

The official documentation says: 

" There can be multiple servers and replicas within the IdM server topology. 
When a client needs to connect to a server for updates or to retrieve user 
information, it (by default) uses a service scan to discover available servers 
and replicas in the domain. This means that the actual server to which the 
client connects is random, depending on the results of the discovery scan."

But there's no information how this scan is done. 

I have to provide the server and the domain during the client installation. But 
regarding to the documentation, the server can by any server or replica in my 
topology. This server is saved also in the
/etc/ipa/default.conf

How is the service scan working and is there a way to manually check what the 
service-check is returning?

With best regards,

Mario Keller
IT-Operations Engineer
 
--
Cornelsen Verlag GmbH, Mecklenburgische Straße 53, 14197 Berlin
Tel: +49 30 897 85-8364, Fax: +49 30 897 85-97-8364
E-Mail: mario.kel...@cornelsen.de | cornelsen.de

AG Charlottenburg, HRB 114796 B
Geschäftsführung: Dr. Anja Hagen, Joachim Herbst, Mark van Mierle (Vorsitz), 
Patrick Neiss, Michael von Smolinski, Frank Thalhofer


-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Reply via email to