IPA server Multi Master setup on Centos/Redhat 8

In this video a multi master replica server setup has been performed on CentOs 8. The method is same for Redhat 8 also.
Steps
Setup Primary server~~~~~
install Centos 8
setup ip and hostname
add hosts entry
Enable IPA appstream module and install ipaserver+dns package
ipa-server-install --auto-reverse --forwarder=1.1.1.1 --forwarder=8.8.8.8 --setup-dns --setup-kra --idstart=2000 --idmax=200000 -p redhat123 -a redhat123 -r MYLAB.LOCAL -n mylab.local --hostname=ipa81.mylab.local --no-host-dns
open firewall for services
Setup replica server~~~~
install centos 8
setup ip and hostname
add hosts entry
Enable IPA appstream module and install ipaserver+dns package
ipa-client-install --hostname ipa82.mylab.local --domain mylab.local --realm MYLAB.LOCAL --server ipa81.mylab.local
add newly added host in ipaservers hostgroup
ipa hostgroup-add-member ipaservers --hosts=ipa82.mylab.local
check dns record
ipa dnsrecord-find mylab.local
now add dns record
ipa dnsrecord-add mylab.local ipa82 --a-rec 192.168.1.115
open firewall for service
run command
ipa-replica-install --no-host-dns
now run
ipa-ca-install --- will take time
ipa-dns-install

[@EugeneKrechkovsky]

Thank you Best faq about ipa server setup + replica Internet truly full of info about it, but you explained it perfectly Really man, thank you😊

[@rukeshkumar5459]

Thanks for this video....nice information for IPA cluster configuration.

[@mariuszstysiak831]

Vijay, congrats, excellent video.

[@james3177]

Great video. Best tutorial I have seen on this. As an FYI, I got the error of "ipa: ERROR: did not receive Kerberos credentials" when adding second host to ipaserver group and when adding the A DNS record. Was able to do them in web UI and continue.

[@CrazyInCloud]

Yes that’s obvious because you dont have krb token.to get this run kinit admin

[@james3177]

@@CrazyInCloud thank you. missed that in my learnings

[@mohammadmonjur-e-elahi6210]

Really helpfull. Can you a make any video tutorial regarding active directory integration so that it could help many? I could not find any video explaining stp by step for freeipa integration with active directory. Thanks in advance.

[@PraveenKumar-iw4cg]

Excellent Video. Could you please make an video how to integrate Windows AD with FreeIPA for RHEL 8

[@yukeshhari7120]

Thanks for this wonderful video. I have a query, how does the master election happens in a Multi-Master setup(ex: 3 replicas) when the master server goes down. Thanks in advance.

[@CrazyInCloud]

Hey Yukesh! IPA does not have native HA feautre, so we do not need a quorum here. We are creating replication not the cluster. Two nodes are sufficient. Everywhere in client, for authentication you can mention both the server( linux and applications support usually) If you are still keen to setup a single endpoint hen use dns feature.Create two A recod of same name. And use dns name in your client config for ipa server.

[@rukeshkumar5459]

Please help:- on IPA2 machine:- ipa-replica-install --setup-dns --setup-ca --no-forwarders /var/lib/ipa/replica-info-node1.testlab.com.gpg its failing here:- Done configuring the web interface (httpd). Configuring ipa-otpd [1/2]: starting ipa-otpd [2/2]: configuring ipa-otpd to start on boot Done configuring ipa-otpd. Configuring ipa-custodia [1/5]: Making sure custodia container exists [2/5]: Generating ipa-custodia config file [3/5]: Generating ipa-custodia keys [4/5]: starting ipa-custodia [5/5]: configuring ipa-custodia to start on boot Done configuring ipa-custodia. Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes [1/30]: configuring certificate server instance ipaserver.install.dogtaginstance: CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmps8DFvq' returned non-zero exit status 1 ipaserver.install.dogtaginstance: CRITICAL See the installation logs and the following files/directories for more information: ipaserver.install.dogtaginstance: CRITICAL /var/log/pki/pki-tomcat [error] RuntimeError: CA configuration failed. Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. ipapython.admintool: ERROR CA configuration failed. ipapython.admintool: ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information

[@thebe_2664]

Hi Vijay I'm following your instruction but I'm not installing on local machine, I'm installing directly on a 2 droplets at DigitalOcean. So I would like to know if the command below is relevant for my setup: ipa-server-install --auto-reverse --forwarder=1.1.1.1 --forwarder=8.8.8.8 --setup-dns --setup-kra --idstart=2000 --idmax=200000 -p redhat123 -a redhat123 -r MYLAB.LOCAL -n mylab.local --hostname=ipa81.mylab.local --no-host-dns

[@CrazyInCloud]

Yes thats correct it will work.