Bug 813880 - Improvement: promoting and recycling replicas/servers
Improvement: promoting and recycling replicas/servers
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: doc-Identity_Management_Guide (Show other bugs)
6.3
Unspecified Unspecified
medium Severity medium
: rc
: ---
Assigned To: Deon Ballard
ecs-bugs
: Documentation
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2012-04-18 12:22 EDT by Deon Ballard
Modified: 2012-07-02 22:54 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2012-07-02 22:54:41 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Deon Ballard 2012-04-18 12:22:27 EDT
There is a section on promoting a replica to a server. It's really not well explained what is happening or why because replicas and servers are functionally identical, with one exception.

There are two problems that need to be addressed:

1. The replica promotion process itself needs to be clarified.

2. There needs to be a larger explanation on how to decommission and re-install replicas and servers.
Comment 1 Deon Ballard 2012-04-18 12:35:57 EDT
So, for part 1:

Only the first CA generates the CRL. All this promotion change does is defines which of the remaining servers will generate the CRL. We want to change the language of "promotion" but it is still true that all the CAs are peers. 

For selfsign, the CA cert needs to be imported into the Apache databsae (/etc/httpd/alias), not 389-ds. The cacert.p12 is the file generated during installation that was saved by the user.
Comment 2 Deon Ballard 2012-04-18 12:38:53 EDT
Part 2:

This probably needs to come from dev, but there needs to be a blessed procedure for wiping out a server or replica cleanly (part 2a) and then re-installing it later (part 2b).
Comment 5 Deon Ballard 2012-06-22 17:48:44 EDT
Okay, changes...

For comment #1. Working backwards, self-signed CAs (for other reasons) have been dropped from the documentation entirely. While still possible to configure, this is very much not a recommended or supported option. Less said, the better.

All that "promoting" a replica means is having one server take over CRL generation for the domain. That is, hopefully, more clear here:
http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/promoting-replica.html

For comment #2, there is a procedure to remove a replica:
http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/removing-replica.html

There is no specific procedure for re-installing a replica.

Note You need to log in before you can comment on or make changes to this bug.