Chapter 3. Using Ansible to manage the replication topology in IdM You can maintain multiple Identity Management (IdM) servers and let them replicate each other for redundancy purposes to mitigate or prevent server loss. For example, if one server fails, the other servers keep providing services to the domain. You can also recover the lost server by creating a new replica based on one of the remaining servers. Data stored on an IdM server is replicated based on replication agreements: when two servers have a replication agreement configured, they share their data. The data that is replicated is stored in the topology suffixes . When two replicas have a replication agreement between their suffixes, the suffixes form a topology segment . This chapter describes how to use Ansible to manage IdM replication agreements, topology segments, and topology suffixes. 3.1. Using Ansible to ensure a replication agreement exists in IdM Data stored on an Identity Management (IdM) server is replicated based on replication agreements: when two servers have a replication agreement configured, they share their data. Replication agreements are always bilateral: the data is replicated from the first replica to the other one as well as from the other replica to the first one. Follow this procedure to use an Ansible playbook to ensure that a replication agreement of the domain type exists between server.idm.example.com and replica.idm.example.com . Prerequisites Ensure that you understand the recommendations for designing your IdM topology listed in Guidelines for connecting IdM replicas in a topology . You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.15 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password and that you have access to a file that stores the password protecting the secret.yml file. The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to your ~/ MyPlaybooks / directory: Copy the add-topologysegment.yml Ansible playbook file provided by the ansible-freeipa package: Open the add-topologysegment-copy.yml file for editing. Adapt the file by setting the following variables in the ipatopologysegment task section: Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file. Set the suffix variable to either domain or ca , depending on what type of segment you want to add. Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement. Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement. Ensure that the state variable is set to present . This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Additional resources Explaining Replication Agreements, Topology Suffixes, and Topology Segments /usr/share/doc/ansible-freeipa/README-topology.md Sample playbooks in /usr/share/doc/ansible-freeipa/playbooks/topology 3.2. Using Ansible to ensure replication agreements exist between multiple IdM replicas Data stored on an Identity Management (IdM) server is replicated based on replication agreements: when two servers have a replication agreement configured, they share their data. Replication agreements are always bilateral: the data is replicated from the first replica to the other one as well as from the other replica to the first one. Follow this procedure to ensure replication agreements exist between multiple pairs of replicas in IdM. Prerequisites Ensure that you understand the recommendations for designing your IdM topology listed in Connecting the replicas in a topology . You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.15 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password and that you have access to a file that stores the password protecting the secret.yml file. The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to your ~/ MyPlaybooks / directory: Copy the add-topologysegments.yml Ansible playbook file provided by the ansible-freeipa package: Open the add-topologysegments-copy.yml file for editing. Adapt the file by setting the following variables in the vars section: Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file. For every topology segment, add a line in the ipatopology_segments section and set the following variables: Set the suffix variable to either domain or ca , depending on what type of segment you want to add. Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement. Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement. In the tasks section of the add-topologysegments-copy.yml file, ensure that the state variable is set to present . This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Additional resources Explaining Replication Agreements, Topology Suffixes, and Topology Segments /usr/share/doc/ansible-freeipa/README-topology.md Sample playbooks in /usr/share/doc/ansible-freeipa/playbooks/topology 3.3. Using Ansible to check if a replication agreement exists between two replicas Data stored on an Identity Management (IdM) server is replicated based on replication agreements: when two servers have a replication agreement configured, they share their data. Replication agreements are always bilateral: the data is replicated from the first replica to the other one as well as from the other replica to the first one. Follow this procedure to verify that replication agreements exist between multiple pairs of replicas in IdM. In contrast to Using Ansible to ensure a replication agreement exists in IdM , this procedure does not modify the existing configuration. Prerequisites Ensure that you understand the recommendations for designing your Identity Management (IdM) topology listed in Connecting the replicas in a topology . You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.15 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password and that you have access to a file that stores the password protecting the secret.yml file. The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to your ~/ MyPlaybooks / directory: Copy the check-topologysegments.yml Ansible playbook file provided by the ansible-freeipa package: Open the check-topologysegments-copy.yml file for editing. Adapt the file by setting the following variables in the vars section: Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file. For every topology segment, add a line in the ipatopology_segments section and set the following variables: Set the suffix variable to either domain or ca , depending on the type of segment you are adding. Set the left variable to the name of the IdM server that you want to be the left node of the replication agreement. Set the right variable to the name of the IdM server that you want to be the right node of the replication agreement. In the tasks section of the check-topologysegments-copy.yml file, ensure that the state variable is set to present . This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Additional resources Explaining Replication Agreements, Topology Suffixes, and Topology Segments /usr/share/doc/ansible-freeipa/README-topology.md Sample playbooks in /usr/share/doc/ansible-freeipa/playbooks/topology 3.4. Using Ansible to verify that a topology suffix exists in IdM In the context of replication agreements in Identity Management (IdM), topology suffixes store the data that is replicated. IdM supports two types of topology suffixes: domain and ca . Each suffix represents a separate back end, a separate replication topology. When a replication agreement is configured, it joins two topology suffixes of the same type on two different servers. The domain suffix contains all domain-related data, such as data about users, groups, and policies. The ca suffix contains data for the Certificate System component. It is only present on servers with a certificate authority (CA) installed. Follow this procedure to use an Ansible playbook to ensure that a topology suffix exists in IdM. The example describes how to ensure that the domain suffix exists in IdM. Prerequisites You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.15 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password and that you have access to a file that stores the password protecting the secret.yml file. The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to your ~/ MyPlaybooks / directory: Copy the verify-topologysuffix.yml Ansible playbook file provided by the ansible-freeipa package: Open the verify-topologysuffix-copy.yml Ansible playbook file for editing. Adapt the file by setting the following variables in the ipatopologysuffix section: Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file. Set the suffix variable to domain . If you are verifying the presence of the ca suffix, set the variable to ca . Ensure that the state variable is set to verified . No other option is possible. This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Additional resources Explaining Replication Agreements, Topology Suffixes, and Topology Segments /usr/share/doc/ansible-freeipa/README-topology.md Sample playbooks in /usr/share/doc/ansible-freeipa/playbooks/topology 3.5. Using Ansible to reinitialize an IdM replica If a replica has been offline for a long period of time or its database has been corrupted, you can reinitialize it. Reinitialization refreshes the replica with an updated set of data. Reinitialization can, for example, be used if an authoritative restore from backup is required. Note In contrast to replication updates, during which replicas only send changed entries to each other, reinitialization refreshes the whole database. The local host on which you run the command is the reinitialized replica. To specify the replica from which the data is obtained, use the direction option. Follow this procedure to use an Ansible playbook to reinitialize the domain data on replica.idm.example.com from server.idm.example.com . Prerequisites You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.15 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password and that you have access to a file that stores the password protecting the secret.yml file. The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to your ~/ MyPlaybooks / directory: Copy the reinitialize-topologysegment.yml Ansible playbook file provided by the ansible-freeipa package: Open the reinitialize-topologysegment-copy.yml file for editing. Adapt the file by setting the following variables in the ipatopologysegment section: Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file. Set the suffix variable to domain . If you are reinitializing the ca data, set the variable to ca . Set the left variable to the left node of the replication agreement. Set the right variable to the right node of the replication agreement. Set the direction variable to the direction of the reinitializing data. The left-to-right direction means that data flows from the left node to the right node. Ensure that the state variable is set to reinitialized . This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Additional resources Explaining Replication Agreements, Topology Suffixes, and Topology Segments /usr/share/doc/ansible-freeipa/README-topology.md Sample playbooks in /usr/share/doc/ansible-freeipa/playbooks/topology 3.6. Using Ansible to ensure a replication agreement is absent in IdM Data stored on an Identity Management (IdM) server is replicated based on replication agreements: when two servers have a replication agreement configured, they share their data. Replication agreements are always bilateral: the data is replicated from the first replica to the other one as well as from the other replica to the first one. Follow this procedure to ensure a replication agreement between two replicas does not exist in IdM. The example describes how to ensure a replication agreement of the domain type does not exist between the replica01.idm.example.com and replica02.idm.example.com IdM servers. Prerequisites You understand the recommendations for designing your IdM topology listed in Connecting the replicas in a topology . You have configured your Ansible control node to meet the following requirements: You are using Ansible version 2.15 or later. You have installed the ansible-freeipa package. The example assumes that in the ~/ MyPlaybooks / directory, you have created an Ansible inventory file with the fully-qualified domain name (FQDN) of the IdM server. The example assumes that the secret.yml Ansible vault stores your ipaadmin_password and that you have access to a file that stores the password protecting the secret.yml file. The target node, that is the node on which the ansible-freeipa module is executed, is part of the IdM domain as an IdM client, server or replica. Procedure Navigate to your ~/ MyPlaybooks / directory: Copy the delete-topologysegment.yml Ansible playbook file provided by the ansible-freeipa package: Open the delete-topologysegment-copy.yml file for editing. Adapt the file by setting the following variables in the ipatopologysegment task section: Indicate that the value of the ipaadmin_password variable is defined in the secret.yml Ansible vault file. Set the suffix variable to domain . Alternatively, if you are ensuring that the ca data are not replicated between the left and right nodes, set the variable to ca . Set the left variable to the name of the IdM server that is the left node of the replication agreement. Set the right variable to the name of the IdM server that is the right node of the replication agreement. Ensure that the state variable is set to absent . This is the modified Ansible playbook file for the current example: Save the file. Run the Ansible playbook. Specify the playbook file, the file storing the password protecting the secret.yml file, and the inventory file: Additional resources Explaining Replication Agreements, Topology Suffixes, and Topology Segments /usr/share/doc/ansible-freeipa/README-topology.md Sample playbooks in /usr/share/doc/ansible-freeipa/playbooks/topology 3.7. Additional resources Planning the replica topology . Installing an IdM replica .

Commands:
cd ~/ MyPlaybooks /
cp /usr/share/doc/ansible-freeipa/playbooks/topology/add-topologysegment.yml add-topologysegment-copy.yml
--- - name: Playbook to handle topologysegment hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Add topology segment ipatopologysegment: ipaadmin_password: "{{ ipaadmin_password }}" suffix: domain left: server.idm.example.com right: replica.idm.example.com state: present
ansible-playbook --vault-password-file=password_file -v -i inventory add-topologysegment-copy.yml
cd ~/ MyPlaybooks /
cp /usr/share/doc/ansible-freeipa/playbooks/topology/add-topologysegments.yml add-topologysegments-copy.yml
--- - name: Add topology segments hosts: ipaserver gather_facts: false vars: ipaadmin_password: "{{ ipaadmin_password }}" ipatopology_segments: - {suffix: domain, left: replica1.idm.example.com , right: replica2.idm.example.com } - {suffix: domain, left: replica2.idm.example.com , right: replica3.idm.example.com } - {suffix: domain, left: replica3.idm.example.com , right: replica4.idm.example.com } - {suffix: domain+ca, left: replica4.idm.example.com , right: replica1.idm.example.com } vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Add topology segment ipatopologysegment: ipaadmin_password: "{{ ipaadmin_password }}" suffix: "{{ item.suffix }}" name: "{{ item.name | default(omit) }}" left: "{{ item.left }}" right: "{{ item.right }}" state: present loop: "{{ ipatopology_segments | default([]) }}"
ansible-playbook --vault-password-file=password_file -v -i inventory add-topologysegments-copy.yml
cd ~/ MyPlaybooks /
cp /usr/share/doc/ansible-freeipa/playbooks/topology/check-topologysegments.yml check-topologysegments-copy.yml
--- - name: Add topology segments hosts: ipaserver gather_facts: false vars: ipaadmin_password: "{{ ipaadmin_password }}" ipatopology_segments: - {suffix: domain, left: replica1.idm.example.com, right: replica2.idm.example.com } - {suffix: domain, left: replica2.idm.example.com , right: replica3.idm.example.com } - {suffix: domain, left: replica3.idm.example.com , right: replica4.idm.example.com } - {suffix: domain+ca, left: replica4.idm.example.com , right: replica1.idm.example.com } vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Check topology segment ipatopologysegment: ipaadmin_password: "{{ ipaadmin_password }}" suffix: "{{ item.suffix }}" name: "{{ item.name | default(omit) }}" left: "{{ item.left }}" right: "{{ item.right }}" state: checked loop: "{{ ipatopology_segments | default([]) }}"
ansible-playbook --vault-password-file=password_file -v -i inventory check-topologysegments-copy.yml
cd ~/ MyPlaybooks /
cp /usr/share/doc/ansible-freeipa/playbooks/topology/ verify-topologysuffix.yml verify-topologysuffix-copy.yml
--- - name: Playbook to handle topologysuffix hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Verify topology suffix ipatopologysuffix: ipaadmin_password: "{{ ipaadmin_password }}" suffix: domain state: verified
ansible-playbook --vault-password-file=password_file -v -i inventory verify-topologysuffix-copy.yml
cd ~/ MyPlaybooks /
cp /usr/share/doc/ansible-freeipa/playbooks/topology/reinitialize-topologysegment.yml reinitialize-topologysegment-copy.yml
--- - name: Playbook to handle topologysegment hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Reinitialize topology segment ipatopologysegment: ipaadmin_password: "{{ ipaadmin_password }}" suffix: domain left: server.idm.example.com right: replica.idm.example.com direction: left-to-right state: reinitialized
ansible-playbook --vault-password-file=password_file -v -i inventory reinitialize-topologysegment-copy.yml
cd ~/ MyPlaybooks /
cp /usr/share/doc/ansible-freeipa/playbooks/topology/delete-topologysegment.yml delete-topologysegment-copy.yml
--- - name: Playbook to handle topologysegment hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: Delete topology segment ipatopologysegment: ipaadmin_password: "{{ ipaadmin_password }}" suffix: domain left: replica01.idm.example.com right: replica02.idm.example.com: state: absent
ansible-playbook --vault-password-file=password_file -v -i inventory delete-topologysegment-copy.yml