Chapter 5. Installing an IdM server: With integrated DNS, without a CA
Installing a new Identity Management (IdM) server with integrated DNS has the following advantages:
- You can automate much of the maintenance and DNS record management using native IdM tools. For example, DNS SRV records are automatically created during the setup, and later on are automatically updated.
- You can have a stable connection with the rest of the Internet by setting up global forwarders during the installation of the IdM server. Global forwarders are also useful for trusts with Active Directory.
- You can set up a DNS reverse zone to prevent emails from your domain to be considered spam by email servers outside of the IdM domain.
Installing IdM with integrated DNS has certain limitations:
- IdM DNS is not meant to be used as a general-purpose DNS server. Some of the advanced DNS functions are not supported.
This chapter describes how you can install a new IdM server without a certificate authority (CA).
5.1. Certificates required to install an IdM server without a CA
You need to provide the certificates required to install an Identity Management (IdM) server without a certificate authority (CA). By using the command-line options described, you can provide these certificates to the
You cannot install a server or replica using self-signed third-party server certificates because the imported certificate files must contain the full CA certificate chain of the CA that issued the LDAP and Apache server certificates.
- The LDAP server certificate and private key
--dirsrv-cert-filefor the certificate and private key files for the LDAP server certificate
--dirsrv-pinfor the password to access the private key in the files specified in
- The Apache server certificate and private key
--http-cert-filefor the certificate and private key files for the Apache server certificate
--http-pinfor the password to access the private key in the files specified in
- The full CA certificate chain of the CA that issued the LDAP and Apache server certificates
--http-cert-filefor the certificate files with the full CA certificate chain or a part of it
You can provide the files specified in the
--http-cert-file options in the following formats:
- Privacy-Enhanced Mail (PEM) encoded certificate (RFC 7468). Note that the Identity Management installer accepts concatenated PEM-encoded objects.
- Distinguished Encoding Rules (DER)
- PKCS #7 certificate chain objects
- PKCS #8 private key objects
- PKCS #12 archives
You can specify the
--http-cert-file options multiple times to specify multiple files.
- The certificate files to complete the full CA certificate chain (not needed in some environments)
--ca-cert-filefor the file or files containing the CA certificate of the CA that issued the LDAP, Apache Server, and Kerberos KDC certificates. Use this option if the CA certificate is not present in the certificate files provided by the other options.
The files provided using
--http-cert-file combined with the file provided using
--ca-cert-file must contain the full CA certificate chain of the CA that issued the LDAP and Apache server certificates.
- The Kerberos key distribution center (KDC) PKINIT certificate and private key
If you have a PKINIT certificate, use the following 2 options:
--pkinit-cert-filefor the Kerberos KDC SSL certificate and private key
--pkinit-pinfor the password to access the Kerberos KDC private key in the files specified in
If you do not have a PKINIT certificate and want to configure the IdM server with a local KDC with a self-signed certificate, use the following option:
--no-pkinitfor disabling pkinit setup steps
For details on what the certificate file formats these options accept, see the
ipa-server-install(1) man page.
- For details on PKINIT extensions required to create a RHEL IdM PKINIT certificate, see RHEL IdM PKINIT KDC certificate and extensions.
5.2. Interactive installation
During the interactive installation using the
ipa-server-install utility, you are asked to supply basic configuration of the system, for example the realm, the administrator’s password and the Directory Manager’s password.
ipa-server-install installation script creates a log file at
/var/log/ipaserver-install.log. If the installation fails, the log can help you identify the problem.
ipa-server-installutility and provide all the required certificates. For example:
[root@server ~]# ipa-server-install \ --http-cert-file /tmp/server.crt \ --http-cert-file /tmp/server.key \ --http-pin secret \ --dirsrv-cert-file /tmp/server.crt \ --dirsrv-cert-file /tmp/server.key \ --dirsrv-pin secret \ --ca-cert-file ca.crt
See Certificates required to install an IdM server without a CA for details on the provided certificates.
The script prompts to configure an integrated DNS service. Enter
no. In this procedure, we are installing a server with integrated DNS.
Do you want to configure integrated DNS (BIND)? [no]:
If you want to install a server without integrated DNS, the installation script will not prompt you for DNS configuration as described in the steps below. See Installing an IdM server: Without integrated DNS, with an integrated CA as the root CA for details on the steps for installing a server without DNS.
The script prompts for several required settings and offers recommended default values in brackets.
- To accept a default value, press Enter.
To provide a custom value, enter the required value.
Server host name [server.idm.example.com]: Please confirm the domain name [idm.example.com]: Please provide a realm name [IDM.EXAMPLE.COM]:Warning
Plan these names carefully. You will not be able to change them after the installation is complete.
Enter the passwords for the Directory Server superuser (
cn=Directory Manager) and for the Identity Management (IdM) administration system user account (
Directory Manager password: IPA admin password:
The script prompts for per-server DNS forwarders.
Do you want to configure DNS forwarders? [yes]:
To configure per-server DNS forwarders, enter
yes, and then follow the instructions on the command line. The installation process will add the forwarder IP addresses to the IdM LDAP.
For the forwarding policy default settings, see the
--forward-policydescription in the ipa-dns-install(1) man page.
- For the forwarding policy default settings, see the
If you do not want to use DNS forwarding, enter
With no DNS forwarders, hosts in your IdM domain will not be able to resolve names from other, internal, DNS domains in your infrastructure. The hosts will only be left with public DNS servers to resolve their DNS queries.
The script prompts to check if any DNS reverse (PTR) records for the IP addresses associated with the server need to be configured.
Do you want to search for missing reverse zones? [yes]:
If you run the search and missing reverse zones are discovered, the script asks you whether to create the reverse zones along with the PTR records.
Do you want to create reverse zone for IP 192.0.2.1 [yes]: Please specify the reverse zone name [2.0.192.in-addr.arpa.]: Using reverse zone(s) 2.0.192.in-addr.arpa.Note
Using IdM to manage reverse zones is optional. You can use an external DNS service for this purpose instead.
yesto confirm the server configuration.
Continue to configure the system with these values? [no]:
- The installation script now configures the server. Wait for the operation to complete.
After the installation script completes, update your DNS records in the following way:
Add DNS delegation from the parent domain to the IdM DNS domain. For example, if the IdM DNS domain is
idm.example.com, add a name server (NS) record to the
Repeat this step each time after an IdM DNS server is installed.
_ntp._udpservice (SRV) record for your time server to your IdM DNS. The presence of the SRV record for the time server of the newly-installed IdM server in IdM DNS ensures that future replica and client installations are automatically configured to synchronize with the time server used by this primary IdM server.