Red Hat Identity Management (IdM) Multi-Zone & Multi-DC Production Guide

This guide describes the complete implementation of a highly available Red Hat Identity Management (IdM) infrastructure featuring 3 logical security zones (Left, Right, Bottom) distributed across 2 physical Data Centers (DC1, DC2) for the domain 0x42.dev.

It covers the architectural matrix, the integration of trusted third-party certificates (External CA), server configuration, secure domain enrollment, and the centralized management of users, groups, and sudo rules.

1. Architectural & Replication Design

1.1 The Zone and Data Center Grid (6-Server Matrix)

To cross network barriers while ensuring seamless failover if an entire data center goes offline, a 6-server matrix is the absolute structural minimum. This configuration guarantees that every logical network zone maintains a local, directly accessible gateway at each physical site.

1.2 Replication Topology

To minimize replication overhead, a dual-ring topology with cross-links is utilized:

• DC-Internal Rings: Within DC1, replication runs via u1 <-> r1 <-> l1. Within DC2, it runs via u2 <-> r2 <-> l2.
• Cross-DC Zone Bridges: Servers belonging to the same network zone are directly connected across data centers (u1 <-> u2, r1 <-> r2, l1 <-> l2).

==================================================================================================
                           0x42.dev - MULTI-ZONE / MULTI-DC ARCHITECTURE
==================================================================================================

          +-----------------------------------+   +-----------------------------------+
          |     DATA CENTER 1 (DC1)           |   |     DATA CENTER 2 (DC2)           |
          +-----------------------------------+   +-----------------------------------+
          |                                   |   |                                   |
          |   +---------------------------+   |   |   +---------------------------+   |
ZONE      |   | idm-l1.0x42.dev           |===|===|===| idm-l2.0x42.dev           |   |
LEFT      |   | (Replica + DNS)           |   |   |   | (Replica + DNS)           |   |
          |   +---------------------------+   |   |   +---------------------------+   |
          |                 ^                 |   |                 ^                 |
          |                 | (DC-Internal    |   |                 | (DC-Internal    |
          |                 v     Ring)       |   |                 v     Ring)       |
          |   +---------------------------+   |   |   +---------------------------+   |
ZONE      |   | idm-r1.0x42.dev           |===|===|===| idm-r2.0x42.dev           |   |
RIGHT     |   | (Replica + DNS)           |   |   |   | (Replica + DNS)           |   |
          |   +---------------------------+   |   |   +---------------------------+   |
          |                 ^                 |   |                 ^                 |
          |                 |                 |   |                 |                 |
          |                 v                 |   |                 v                 |
          |   +---------------------------+   |   |   +---------------------------+   |
ZONE      |   | idm-u1.0x42.dev           |===|===|===| idm-u2.0x42.dev           |   |
BOTTOM    |   | (Initial Master + CA)     |   |   |   | (Replica + CA + DNS)      |   |
(Mgmt)    |   +---------------------------+   |   |   +---------------------------+   |
          |                                   |   |                                   |
          +-----------------------------------+   +-----------------------------------+

Legend:
  === : Cross-DC Zone Bridge (Failsafe WAN Link)
  |   : Data Center Internal Replication Ring

2. Prerequisites (Execute on All 6 Servers)

Run these steps on every system before initiating the IdM installation.

Hostname & Firewall Configuration

⚠️ CRITICAL: The RHEL installer does NOT open firewall ports automatically. Setup will fail if ports are blocked!

# Set FQDN according to the specific server (Example for idm-u1)
sudo hostnamectl set-hostname idm-u1.0x42.dev

# Permanently allow required IdM ports in the local firewall
sudo firewall-cmd --permanent --add-service={freeipa-ldap,freeipa-ldaps,dns,kerberos,kpasswd,http,https}
sudo firewall-cmd --reload

Prepare RHEL Modules & Packages

# Enable the IdM AppStream module and install server packages
sudo dnf module enable idm:DL1 -y
sudo dnf install ipa-server ipa-server-dns -y

3. Step-by-Step Installation Order

Certificate Infrastructure (External CA Integration)

By default, IdM generates a self-signed Root CA. For an enterprise production environment, we integrate IdM as a Sub-CA (Intermediate CA) within your trusted corporate PKI.

Step 3.1: Generate CSR (Certificate Signing Request) on idm-u1

Execute the first phase of the installation on idm-u1 using the --external-ca parameter:

sudo ipa-server-install   --realm=0X42.DEV   --domain=0x42.dev   --hostname=idm-u1.0x42.dev   --setup-dns   --auto-forwarder   --no-ntp   --external-ca

Step 3.2: Signing by Corporate PKI

The installer creates a CSR file at /root/ipa.csr.

1. Submit /root/ipa.csr to your internal Certificate Authority.
2. Ensure the issued certificate is approved for Certificate Signing (Sub-CA / CA:TRUE).
3. Export the signed certificate as a PEM (Base64) file (e.g., ipa-ca.crt).
4. Export the complete root certificate chain as a PEM file (e.g., root-chain.crt).
5. Copy both files back onto the idm-u1 server inside /root/.

Step 3.3: Resume Installation on idm-u1

Run the installer again, supplying the signed certificate and trust chain:

sudo ipa-server-install   --external-cert-file=/root/ipa-ca.crt   --external-cert-file=/root/root-chain.crt

Installing the Remaining 5 Servers

After the master installation is complete on idm-u1, generate a valid Kerberos ticket:

kinit admin

Step 3.4: Set up Zone Bottom / DC2 (idm-u2.0x42.dev)

This server clones the CA infrastructure from idm-u1 for maximum redundancy:

sudo ipa-replica-install --server=idm-u1.0x42.dev --setup-dns --setup-ca

Step 3.5: Set up Zones Left & Right in DC1

# On idm-l1.0x42.dev (Left / DC1)
sudo ipa-replica-install --server=idm-u1.0x42.dev --setup-dns

# On idm-r1.0x42.dev (Right / DC1)
sudo ipa-replica-install --server=idm-u1.0x42.dev --setup-dns

Step 3.6: Set up Zones Left & Right in DC2

# On idm-l2.0x42.dev (Left / DC2)
sudo ipa-replica-install --server=idm-u2.0x42.dev --setup-dns

# On idm-r2.0x42.dev (Right / DC2)
sudo ipa-replica-install --server=idm-u2.0x42.dev --setup-dns

Step 3.7: Configure Replication Topology

Run these commands on idm-u1.0x42.dev to establish the optimized network topology:

# Close DC-internal rings
ipa topologysegment-add domain l1-to-r1 --leftnode=idm-l1.0x42.dev --rightnode=idm-r1.0x42.dev
ipa topologysegment-add domain l2-to-r2 --leftnode=idm-l2.0x42.dev --rightnode=idm-r2.0x42.dev

# Establish cross-DC zone bridges
ipa topologysegment-add domain links-dc1-to-dc2 --leftnode=idm-l1.0x42.dev --rightnode=idm-l2.0x42.dev
ipa topologysegment-add domain rechts-dc1-to-dc2 --leftnode=idm-r1.0x42.dev --rightnode=idm-r2.0x42.dev

Step 3.8: Configure DNS Locations

# Create locations
for loc in dc1_links dc1_rechts dc1_unten dc2_links dc2_rechts dc2_unten; do ipa location-add $loc --description="Location $loc"; done

# Assign servers
ipa location-add-member dc1_links  --servers=idm-l1.0x42.dev
ipa location-add-member dc1_rechts --servers=idm-r1.0x42.dev
ipa location-add-member dc1_unten  --servers=idm-u1.0x42.dev
ipa location-add-member dc2_links  --servers=idm-l2.0x42.dev
ipa location-add-member dc2_rechts --servers=idm-r2.0x42.dev
ipa location-add-member dc2_unten  --servers=idm-u2.0x42.dev

4. Integrating the First Linux Client

Execute these steps on the client machine to securely enroll it into the domain.

Step 4.1: Verify Client DNS Configuration (Critical!)

The client must use the IP address of the IdM server from its own zone as its primary DNS nameserver.

# Check if domain name resolution works correctly
host -t SRV _kerberos._udp.0x42.dev

Step 4.2: Deploy Corporate PKI Trust Chain

# Copy the root chain certificate to the trusted anchors directory
sudo cp /path/to/root-chain.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

Step 4.3: Install Client Packages and Run Domain Enrollment

# Install the client package
sudo dnf install ipa-client -y

# Interactive enrollment with automatic SSSD and Kerberos setup
sudo ipa-client-install --mkhomedir

5. Centralized Identity & Access Governance (Users, Groups & Sudo)

Execute the following commands on any IdM server with an active admin ticket (kinit admin).

Step 5.1: Create User and Group

# 1. Create a user group for Linux administrators
ipa group-add linux-admins --desc="Central administrators for Linux systems"

# 2. Add a new user
ipa user-add john.doe   --first="John"   --last="Doe"   --password   --email="john@0x42.dev"

# 3. Assign the user to the administrator group
ipa group-add-member linux-admins --users=john.doe

Step 5.2: Define Host Group

# 1. Create a host group for production systems
ipa hostgroup-add prod-servers --desc="Systems in Zone Right (Production)"

# 2. Add the enrolled client to the group
ipa hostgroup-add-member prod-servers --hosts=appserver01.0x42.dev

Step 5.3: Create Central Sudo Policy

# 1. Register the sudo rule in IdM
ipa sudorule-add run-all-as-root --desc="Allows full root access for Linux admins"

# 2. Define WHO can use this rule (Our user group)
ipa sudorule-add-user run-all-as-root --groups=linux-admins

# 3. Define WHERE this rule applies (Our host group)
ipa sudorule-add-host run-all-as-root --hostgroups=prod-servers

# 4. Define WHICH commands are allowed (In this case, ALL)
ipa sudorule-add-allow-command run-all-as-root --sudocmds=all

# 5. Define WHOM they can run commands as (as root)
ipa sudorule-add-runasuser run-all-as-root --users=root

Step 5.4: Verification on the Client System

Log into the client machine (appserver01.0x42.dev) using the new account.

# 1. Connect to the client via SSH
ssh john.doe@appserver01.0x42.dev

# 2. Check which sudo rules SSSD fetched from the IdM server for this user
sudo -l

6. Monitoring & Synchronization Check

Use these commands on any server to validate the state of the infrastructure:

# Lists all active replication paths (segments)
ipa topologysegment-find domain

# Checks network connectivity across all replication partners
ipa-replica-conncheck

# Shows detailed synchronization status
ipa server-status

7. Firewall & Network Configuration Matrix (Admin Cheat Sheet)

⚠️ PRODUCTION NOTE: Ports must be allowed manually before Step 3, otherwise the installation routine will abort.

Cross-Zone Communication Rules

• Clients to Servers: Clients require access to ports 88, 464, 389, 636, 443, and 53 of the IdM server within their designated zone.
• Server to Server (Replication): All listed ports (including port 22 for initial setup) must be opened fully bidirectionally between servers interconnected according to the topology layout.