1. Select IPA Server → Topology → Topology Graph.
2. If you make any changes to the topology that are not immediately reflected in the graph, click Refresh.

Procedure

1. In the topology graph, hover your mouse over one of the server nodes.

   Figure 1.9. Domain or CA options

   
2. Click on the domain or the ca part of the circle depending on what type of topology segment you want to create.

3. A new arrow representing the new replication agreement appears under your mouse pointer. Move your mouse to the other server node, and click on it.

   Figure 1.10. Creating a new segment

   
4. In the Add topology segment window, click Add to confirm the properties of the new segment.

Procedure

1. Click on an arrow representing the replication agreement you want to remove. This highlights the arrow.

   Figure 1.12. Topology segment highlighted

   
2. Click Delete.
3. In the Confirmation window, click OK.

Procedure

1. Use the ipa topologysegment-add command to create a topology segment for the two servers. When prompted, provide:

   • the required topology suffix: domain or ca
   • the left node and the right node, representing the two servers

   • optionally, a custom name for the segment

     For example:

     $ ipa topologysegment-add
     Suffix name: domain
     Left node: server1.example.com
     Right node: server2.example.com
     Segment name [server1.example.com-to-server2.example.com]: new_segment
     ---------------------------
     Added segment "new_segment"
     ---------------------------
       Segment name: new_segment
       Left node: server1.example.com
       Right node: server2.example.com
       Connectivity: both

     Adding the new segment joins the servers in a replication agreement.

2. Optional. Use the ipa topologysegment-show command to verify that the new segment is configured.

   $ ipa topologysegment-show
   Suffix name: domain
   Segment name: new_segment
     Segment name: new_segment
     Left node: server1.example.com
     Right node: server2.example.com
     Connectivity: both

Procedure

1. To stop replication, you must delete the corresponding replication segment between the servers. To do that, you need to know the segment name.

   If you do not know the name, use the ipa topologysegment-find command to display all segments, and locate the required segment in the output. When prompted, provide the required topology suffix: domain or ca. For example:

   $ ipa topologysegment-find
   Suffix name: domain
   ------------------
   8 segments matched
   ------------------
     Segment name: new_segment
     Left node: server1.example.com
     Right node: server2.example.com
     Connectivity: both
   
   ...
   
   ----------------------------
   Number of entries returned 8
   ----------------------------

2. Use the ipa topologysegment-del command to remove the topology segment joining the two servers.

   $ ipa topologysegment-del
   Suffix name: domain
   Segment name: new_segment
   -----------------------------
   Deleted segment "new_segment"
   -----------------------------

   Deleting the segment removes the replication agreement.

3. Optional. Use the ipa topologysegment-find command to verify that the segment is no longer listed.

   $ ipa topologysegment-find
   Suffix name: domain
   ------------------
   7 segments matched
   ------------------
     Segment name: server2.example.com-to-server3.example.com
     Left node: server2.example.com
     Right node: server3.example.com
     Connectivity: both
   
   ...
   
   ----------------------------
   Number of entries returned 7
   ----------------------------

1. Select IPA Server → Topology → IPA Servers.

2. Click on the name of the server you want to delete.

   Figure 1.14. Selecting a server

   
3. Click Delete Server.

1. On another server, run the ipa server-del command to remove server1.example.com. The command removes all topology segments pointing to the server:

   [user@server2 ~]$ ipa server-del
   Server name: server1.example.com
   Removing server1.example.com from replication topology, please wait...
   ----------------------------------------------------------
   Deleted IPA server "server1.example.com"
   ----------------------------------------------------------

2. Optional: on server1.example.com, run the ipa server-install --uninstall command to uninstall the server components from the machine.

   [root@server1 ~]# ipa server-install --uninstall

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the add-topologysegment.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/topology/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/add-topologysegment.yml add-topologysegment-copy.yml

3. Open the add-topologysegment-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipatopologysegment task section:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the suffix variable to either domain or ca, depending on what type of segment you want to add.
   • Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement.
   • Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement.
   • Ensure that the state variable is set to present.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to handle topologysegment
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
   - name: Add topology segment
       ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: domain
         left: server.idm.example.com
         right: replica.idm.example.com
         state: present

5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory add-topologysegment-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the add-topologysegments.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/topology/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/add-topologysegments.yml add-topologysegments-copy.yml

3. Open the add-topologysegments-copy.yml file for editing.

4. Adapt the file by setting the following variables in the vars section:

   • Set the ipaadmin_password variable to the password of the IdM admin.

   • For every topology segment, add a line in the ipatopology_segments section and set the following variables:

     • Set the suffix variable to either domain or ca, depending on what type of segment you want to add.
     • Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement.
     • Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement.

5. In the tasks section of the add-topologysegments-copy.yml file, ensure that the state variable is set to present.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Add topology segments
     hosts: ipaserver
     gather_facts: false
   
     vars:
       ipaadmin_password: "{{ ipaadmin_password }}"
       ipatopology_segments:
       - {suffix: domain, left: replica1.idm.example.com , right: replica2.idm.example.com }
       - {suffix: domain, left: replica2.idm.example.com , right: replica3.idm.example.com }
       - {suffix: domain, left: replica3.idm.example.com , right: replica4.idm.example.com }
       - {suffix: domain+ca, left: replica4.idm.example.com , right: replica1.idm.example.com }
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Add topology segment
       ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: "{{ item.suffix }}"
         name: "{{ item.name | default(omit) }}"
         left: "{{ item.left }}"
         right: "{{ item.right }}"
         state: present
         #state: absent
         #state: checked
         #state: reinitialized
       loop: "{{ ipatopology_segments | default([]) }}"

6. Save the file.

7. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory add-topologysegments-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the check-topologysegments.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/topology/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/check-topologysegments.yml check-topologysegments-copy.yml

3. Open the check-topologysegments-copy.yml file for editing.

4. Adapt the file by setting the following variables in the vars section:

   • Set the ipaadmin_password variable to the password of the IdM admin.

   • For every topology segment, add a line in the ipatopology_segments section and set the following variables:

     • Set the suffix variable to either domain or ca, depending on the type of segment you are adding.
     • Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement.
     • Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement.

5. In the tasks section of the check-topologysegments-copy.yml file, ensure that the state variable is set to present.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Add topology segments
     hosts: ipaserver
     gather_facts: false
   
     vars:
       ipaadmin_password: "{{ ipaadmin_password }}"
       ipatopology_segments:
       - {suffix: domain, left: replica1.idm.example.com, right: replica2.idm.example.com }
       - {suffix: domain, left: replica2.idm.example.com , right: replica3.idm.example.com }
       - {suffix: domain, left: replica3.idm.example.com , right: replica4.idm.example.com }
       - {suffix: domain+ca, left: replica4.idm.example.com , right: replica1.idm.example.com }
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Check topology segment
       ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: "{{ item.suffix }}"
         name: "{{ item.name | default(omit) }}"
         left: "{{ item.left }}"
         right: "{{ item.right }}"
         state: checked
       loop: "{{ ipatopology_segments | default([]) }}"

6. Save the file.

7. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory check-topologysegments-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the verify-topologysuffix.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/topology/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/ verify-topologysuffix.yml verify-topologysuffix-copy.yml

3. Open the verify-topologysuffix-copy.yml Ansible playbook file for editing.

4. Adapt the file by setting the following variables in the ipatopologysuffix section:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the suffix variable to domain. If you are verifying the presence of the ca suffix, set the variable to ca.
   • Ensure that the state variable is set to verified. No other option is possible.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to handle topologysuffix
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
     - name: Verify topology suffix
       ipatopologysuffix:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: domain
         state: verified

5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory verify-topologysuffix-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the reinitialize-topologysegment.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/topology/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/reinitialize-topologysegment.yml reinitialize-topologysegment-copy.yml

3. Open the reinitialize-topologysegment-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipatopologysegment section:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the suffix variable to domain. If you are reinitializing the ca data, set the variable to ca.
   • Set the left variable to the left node of the replication agreement.
   • Set the right variable to the right node of the replication agreement.
   • Set the direction variable to the direction of the reinitializing data. The left-to-right direction means that data flows from the left node to the right node.

   • Ensure that the state variable is set to reinitialized.

     This is the modified Ansible playbook file for the current example:

     ---
     - name: Playbook to handle topologysegment
       hosts: ipaserver
     
       vars_files:
       - /home/user_name/MyPlaybooks/secret.yml
       tasks:
       - name: Reinitialize topology segment
         ipatopologysegment:
           ipaadmin_password: "{{ ipaadmin_password }}"
           suffix: domain
           left: server.idm.example.com
           right: replica.idm.example.com
           direction: left-to-right
           state: reinitialized

5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory reinitialize-topologysegment-copy.yml

Procedure

1. Navigate to your ~/MyPlaybooks/ directory:

   $ cd ~/MyPlaybooks/

2. Copy the delete-topologysegment.yml Ansible playbook file located in the /usr/share/doc/ansible-freeipa/playbooks/topology/ directory:

   $ cp /usr/share/doc/ansible-freeipa/playbooks/topology/delete-topologysegment.yml delete-topologysegment-copy.yml

3. Open the delete-topologysegment-copy.yml file for editing.

4. Adapt the file by setting the following variables in the ipatopologysegment task section:

   • Set the ipaadmin_password variable to the password of the IdM admin.
   • Set the suffix variable to domain. Alternatively, if you are ensuring that the ca data are not replicated between the left and right nodes, set the variable to ca.
   • Set the left variable to the name of the IdM server that is the left node of the replication agreement.
   • Set the right variable to the name of the IdM server that is the right node of the replication agreement.
   • Ensure that the state variable is set to absent.

   This is the modified Ansible playbook file for the current example:

   ---
   - name: Playbook to handle topologysegment
     hosts: ipaserver
   
     vars_files:
     - /home/user_name/MyPlaybooks/secret.yml
     tasks:
   - name: Delete topology segment
       ipatopologysegment:
         ipaadmin_password: "{{ ipaadmin_password }}"
         suffix: domain
         left: replica01.idm.example.com
         right: replica02.idm.example.com:
         state: absent

5. Save the file.

6. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file:

   $ ansible-playbook --vault-password-file=password_file -v -i inventory delete-topologysegment-copy.yml