The directory servers supported for use with Red Hat Enterprise Virtualization 3.3 are:

From this article,you'll learn following:

Install IPA packages on master and slave

[root@ipa ~]# yum -y install ipa-server bind bind-dyndb-ldap firefox xorg-x11-xauth[root@slave ~]# yum -y install ipa-server bind bind-dyndb-ldap firefox xorg-x11-xauth

Configure master IPA server

[root@ipa ~]# ipa-server-install --setup-dns --forwarder=172.16.255.10The log file for this installation can be found in /var/log/ipaserver-install.log==============================================================================This program will set up the IPA Server.This includes:  * Configure a stand-alone CA (dogtag) for certificate management  * Configure the Network Time Daemon (ntpd)  * Create and configure an instance of Directory Server  * Create and configure a Kerberos Key Distribution Center (KDC)  * Configure Apache (httpd)  * Configure DNS (bind)To accept the default shown in brackets, press the Enter key.Existing BIND configuration detected, overwrite? [no]: yesEnter the fully qualified domain name of the computeron which you're setting up server software. Using the form
    
     .
     
      Example: master.example.com.Server host name [ipa.xzxj.edu.cn]:Warning: skipping DNS resolution of host ipa.xzxj.edu.cnThe domain name has been determined based on the host name.Please confirm the domain name [xzxj.edu.cn]:The kerberos protocol requires a Realm name to be defined.This is typically the domain name converted to uppercase.Please provide a realm name [XZXJ.EDU.CN]:Certain directory server operations require an administrative user.This user is referred to as the Directory Manager and has full accessto the Directory for system management tasks and will be added to theinstance of directory server created for IPA.The password must be at least 8 characters long.Directory Manager password:Password (confirm):The IPA server requires an administrative user, named 'admin'.This user is a regular system account used for IPA server administration.IPA admin password:Password (confirm):Do you want to configure the reverse zone? [yes]:Please specify the reverse zone name [255.16.172.in-addr.arpa.]:Using reverse zone 255.16.172.in-addr.arpa.The IPA Master Server will be configured with:Hostname:      ipa.xzxj.edu.cnIP address:    172.16.255.16Domain name:   xzxj.edu.cnRealm name:    XZXJ.EDU.CNBIND DNS server will be configured to serve IPA domain with:Forwarders:    172.16.255.10Reverse zone:  255.16.172.in-addr.arpa.Continue to configure the system with these values? [no]: yesThe following operations may take some minutes to complete.Please wait until the prompt is returned.Configuring NTP daemon (ntpd)  [1/4]: stopping ntpd  [2/4]: writing configuration  [3/4]: configuring ntpd to start on boot  [4/4]: starting ntpdDone configuring NTP daemon (ntpd).Configuring directory server for the CA (pkids): Estimated time 30 seconds  [1/3]: creating directory server user  [2/3]: creating directory server instance  [3/3]: restarting directory serverDone configuring directory server for the CA (pkids).Configuring certificate server (pki-cad): Estimated time 3 minutes 30 seconds  [1/21]: creating certificate server user  [2/21]: creating pki-ca instance  [3/21]: configuring certificate server instance  [4/21]: disabling nonces  [5/21]: creating CA agent PKCS#12 file in /root  [6/21]: creating RA agent certificate database  [7/21]: importing CA chain to RA certificate database  [8/21]: fixing RA database permissions  [9/21]: setting up signing cert profile  [10/21]: set up CRL publishing  [11/21]: set certificate subject base  [12/21]: enabling Subject Key Identifier  [13/21]: setting audit signing renewal to 2 years  [14/21]: configuring certificate server to start on boot  [15/21]: restarting certificate server  [16/21]: requesting RA certificate from CA  [17/21]: issuing RA agent certificate  [18/21]: adding RA agent as a trusted user  [19/21]: configure certificate renewals  [20/21]: configure Server-Cert certificate renewal  [21/21]: Configure HTTP to proxy connectionsDone configuring certificate server (pki-cad).Configuring directory server (dirsrv): Estimated time 1 minute  [1/38]: creating directory server user  [2/38]: creating directory server instance  [3/38]: adding default schema  [4/38]: enabling memberof plugin  [5/38]: enabling winsync plugin  [6/38]: configuring replication version plugin  [7/38]: enabling IPA enrollment plugin  [8/38]: enabling ldapi  [9/38]: disabling betxn plugins  [10/38]: configuring uniqueness plugin  [11/38]: configuring uuid plugin  [12/38]: configuring modrdn plugin  [13/38]: enabling entryUSN plugin  [14/38]: configuring lockout plugin  [15/38]: creating indices  [16/38]: enabling referential integrity plugin  [17/38]: configuring ssl for ds instance  [18/38]: configuring certmap.conf  [19/38]: configure autobind for root  [20/38]: configure new location for managed entries  [21/38]: restarting directory server  [22/38]: adding default layout  [23/38]: adding delegation layout  [24/38]: adding replication acis  [25/38]: creating container for managed entries  [26/38]: configuring user private groups  [27/38]: configuring netgroups from hostgroups  [28/38]: creating default Sudo bind user  [29/38]: creating default Auto Member layout  [30/38]: adding range check plugin  [31/38]: creating default HBAC rule allow_all  [32/38]: Upload CA cert to the directory  [33/38]: initializing group membership  [34/38]: adding master entry  [35/38]: configuring Posix uid/gid generation  [36/38]: enabling compatibility plugin  [37/38]: tuning directory server  [38/38]: configuring directory to start on bootDone configuring directory server (dirsrv).Configuring Kerberos KDC (krb5kdc): Estimated time 30 seconds  [1/10]: adding sasl mappings to the directory  [2/10]: adding kerberos container to the directory  [3/10]: configuring KDC  [4/10]: initialize kerberos container  [5/10]: adding default ACIs  [6/10]: creating a keytab for the directory  [7/10]: creating a keytab for the machine  [8/10]: adding the password extension to the directory  [9/10]: starting the KDC  [10/10]: configuring KDC to start on bootDone configuring Kerberos KDC (krb5kdc).Configuring kadmin  [1/2]: starting kadmin  [2/2]: configuring kadmin to start on bootDone configuring kadmin.Configuring ipa_memcached  [1/2]: starting ipa_memcached  [2/2]: configuring ipa_memcached to start on bootDone configuring ipa_memcached.Configuring the web interface (httpd): Estimated time 1 minute  [1/13]: setting mod_nss port to 443  [2/13]: setting mod_nss password file  [3/13]: enabling mod_nss renegotiate  [4/13]: adding URL rewriting rules  [5/13]: configuring httpd  [6/13]: setting up ssl  [7/13]: setting up browser autoconfig  [8/13]: publish CA cert  [9/13]: creating a keytab for httpd  [10/13]: clean up any existing httpd ccache  [11/13]: configuring SELinux for httpd  [12/13]: restarting httpd  [13/13]: configuring httpd to start on bootDone configuring the web interface (httpd).Applying LDAP updatesRestarting the directory serverRestarting the KDCConfiguring DNS (named)  [1/9]: adding DNS container  [2/9]: setting up our zone  [3/9]: setting up reverse zone  [4/9]: setting up our own record  [5/9]: setting up kerberos principal  [6/9]: setting up named.conf  [7/9]: restarting named  [8/9]: configuring named to start on boot  [9/9]: changing resolv.conf to point to ourselvesDone configuring DNS (named).Global DNS configuration in LDAP server is emptyYou can use 'dnsconfig-mod' command to set global DNS options thatwould override settings in local named.conf filesRestarting the web server==============================================================================Setup completeNext steps:        1. You must make sure these network ports are open:                TCP Ports:                  * 80, 443: HTTP/HTTPS                  * 389, 636: LDAP/LDAPS                  * 88, 464: kerberos                  * 53: bind                UDP Ports:                  * 88, 464: kerberos                  * 53: bind                  * 123: ntp        2. You can now obtain a kerberos ticket using the command: 'kinit admin'           This ticket will allow you to use the IPA tools (e.g., ipa user-add)           and the web user interface.Be sure to back up the CA certificate stored in /root/cacert.p12This file is required to create replicas. The password for thisfile is the Directory Manager password
     
    

After configure,you need to get a kerberos ticket:

[root@ipa ~]# kinit adminPassword for admin@XZXJ.EDU.CN:[root@ipa ~]# klistTicket cache: FILE:/tmp/krb5cc_0Default principal: admin@XZXJ.EDU.CNValid starting     Expires            Service principal05/17/14 12:18:59  05/18/14 12:18:56  krbtgt/XZXJ.EDU.CN@XZXJ.EDU.CN

Setting up a replica

[root@ipa ~]# ipa-replica-prepare slave.xzxj.edu.cnDirectory Manager (existing master) password:********Preparing replica for slave.xzxj.edu.cn from ipa.xzxj.edu.cnCreating SSL certificate for the Directory ServerCreating SSL certificate for the dogtag Directory ServerCreating SSL certificate for the Web ServerExporting RA certificateCopying additional filesFinalizing configurationPackaging replica information into /var/lib/ipa/replica-info-slave.xzxj.edu.cn.gpg[root@ipa ~]# scp /var/lib/ipa/replica-info-slave.xzxj.edu.cn.gpg slave:/root

Configure slave IPA server

[root@slave ~]# ipa-replica-install --setup-dns --forwarder=172.16.255.10 replica-info-slave.xzxj.edu.cn.gpgDirectory Manager (existing master) password:*******Run connection check to masterCheck connection from replica to remote master 'ipa.xzxj.edu.cn':   Directory Service: Unsecure port (389): OK   Directory Service: Secure port (636): OK   Kerberos KDC: TCP (88): OK   Kerberos Kpasswd: TCP (464): OK   HTTP Server: Unsecure port (80): OK   HTTP Server: Secure port (443): OKThe following list of ports use UDP protocol and would need to bechecked manually:   Kerberos KDC: UDP (88): SKIPPED   Kerberos Kpasswd: UDP (464): SKIPPEDConnection from replica to master is OK.Start listening on required ports for remote master checkGet credentials to log in to remote masteradmin@XZXJ.EDU.CN password:Execute check on remote masterCheck connection from master to remote replica 'slave.xzxj.edu.cn':   Directory Service: Unsecure port (389): OK   Directory Service: Secure port (636): OK   Kerberos KDC: TCP (88): OK   Kerberos KDC: UDP (88): OK   Kerberos Kpasswd: TCP (464): OK   Kerberos Kpasswd: UDP (464): OK   HTTP Server: Unsecure port (80): OK   HTTP Server: Secure port (443): OKConnection from master to replica is OK.Connection check OKConfiguring NTP daemon (ntpd)  [1/4]: stopping ntpd  [2/4]: writing configuration  [3/4]: configuring ntpd to start on boot  [4/4]: starting ntpdDone configuring NTP daemon (ntpd).Configuring directory server (dirsrv): Estimated time 1 minute  [1/31]: creating directory server user  [2/31]: creating directory server instance  [3/31]: adding default schema  [4/31]: enabling memberof plugin  [5/31]: enabling winsync plugin  [6/31]: configuring replication version plugin  [7/31]: enabling IPA enrollment plugin  [8/31]: enabling ldapi  [9/31]: disabling betxn plugins  [10/31]: configuring uniqueness plugin  [11/31]: configuring uuid plugin  [12/31]: configuring modrdn plugin  [13/31]: enabling entryUSN plugin  [14/31]: configuring lockout plugin  [15/31]: creating indices  [16/31]: enabling referential integrity plugin  [17/31]: configuring ssl for ds instance  [18/31]: configuring certmap.conf  [19/31]: configure autobind for root  [20/31]: configure new location for managed entries  [21/31]: restarting directory server  [22/31]: setting up initial replicationStarting replication, please wait until this has completed.Update in progressUpdate in progressUpdate in progressUpdate in progressUpdate succeeded  [23/31]: adding replication acis  [24/31]: setting Auto Member configuration  [25/31]: enabling S4U2Proxy delegation  [26/31]: initializing group membership  [27/31]: adding master entry  [28/31]: configuring Posix uid/gid generation  [29/31]: enabling compatibility plugin  [30/31]: tuning directory server  [31/31]: configuring directory to start on bootDone configuring directory server (dirsrv).Configuring Kerberos KDC (krb5kdc): Estimated time 30 seconds  [1/9]: adding sasl mappings to the directory  [2/9]: writing stash file from DS  [3/9]: configuring KDC  [4/9]: creating a keytab for the directory  [5/9]: creating a keytab for the machine  [6/9]: adding the password extension to the directory  [7/9]: enable GSSAPI for replication  [8/9]: starting the KDC  [9/9]: configuring KDC to start on bootDone configuring Kerberos KDC (krb5kdc).Configuring kadmin  [1/2]: starting kadmin  [2/2]: configuring kadmin to start on bootDone configuring kadmin.Configuring ipa_memcached  [1/2]: starting ipa_memcached  [2/2]: configuring ipa_memcached to start on bootDone configuring ipa_memcached.Configuring the web interface (httpd): Estimated time 1 minute  [1/12]: setting mod_nss port to 443  [2/12]: setting mod_nss password file  [3/12]: enabling mod_nss renegotiate  [4/12]: adding URL rewriting rules  [5/12]: configuring httpd  [6/12]: setting up ssl  [7/12]: publish CA cert  [8/12]: creating a keytab for httpd  [9/12]: clean up any existing httpd ccache  [10/12]: configuring SELinux for httpd  [11/12]: restarting httpd  [12/12]: configuring httpd to start on bootDone configuring the web interface (httpd).Applying LDAP updatesRestarting the directory serverRestarting the KDCUsing reverse zone 255.16.172.in-addr.arpa.Configuring DNS (named)  [1/8]: adding NS record to the zone  [2/8]: setting up reverse zone  [3/8]: setting up our own record  [4/8]: setting up kerberos principal  [5/8]: setting up named.conf  [6/8]: restarting named  [7/8]: configuring named to start on boot  [8/8]: changing resolv.conf to point to ourselvesDone configuring DNS (named).Global DNS configuration in LDAP server is emptyYou can use 'dnsconfig-mod' command to set global DNS options thatwould override settings in local named.conf filesRestarting the web server//Get a Kerberos ticket[root@slave ~]# kinit adminPassword for admin@XZXJ.EDU.CN:[root@slave ~]# klistTicket cache: FILE:/tmp/krb5cc_0Default principal: admin@XZXJ.EDU.CNValid starting     Expires            Service principal05/17/14 15:20:06  05/18/14 15:20:03  krbtgt/XZXJ.EDU.CN@XZXJ.EDU.CN

Some adjustment

Unfortunately the default shell for new users is /bin/sh, which should probably be changed.

[root@slave ~]# ipa config-mod --defaultshell=/bin/bash  Maximum username length: 32  Home directory base: /home  Default shell: /bin/bash  Default users group: ipausers  Default e-mail domain: xzxj.edu.cn  Search time limit: 2  Search size limit: 100  User search fields: uid,givenname,sn,telephonenumber,ou,title  Group search fields: cn,description  Enable migration mode: FALSE  Certificate Subject base: O=XZXJ.EDU.CN  Password Expiration Notification (days): 4  Password plugin features: AllowNThash  SELinux user map order: guest_u:s0$xguest_u:s0$user_u:s0$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023  Default SELinux user: unconfined_u:s0-s0:c0.c1023  Default PAC types: MS-PAC

Testing the replication

Login in to ipa.xzxj.edu.cn and add a new user:

[root@ipa ~]# ipa user-add candonFirst name: aaaaLast name: bb-------------------Added user "candon"-------------------  User login: candon  First name: jacky  Last name: lee  Full name: jacky lee  Display name: jacky lee  Initials: jl  Home directory: /home/candon  GECOS field: jacky lee  Login shell: /bin/bash  Kerberos principal: candon@XZXJ.EDU.CN  Email address: candon@xzxj.edu.cn  UID: 1229200001  GID: 1229200001  Password: False  Kerberos keys available: False[root@ipa named]# ipa passwd candonNew Password:Enter New Password again to verify:-----------------------------------------Changed password for "candon@XZXJ.EDU.CN"-----------------------------------------

Now,you can check if the user is really available on both servers  by following a ldapsearch command:

[root@slave ~]# ldapsearch -x -b "dc=xzxj,dc=edu,dc=cn" uid=candon

Set up a IPA client

[root@TestOS01 ~]# yum  install ipa-client[root@TestOS01 ~]# ipa-client-install -p adminDNS domain 'xzxj.edu.cn' is not configured for automatic KDC address lookup.KDC address will be set to fixed value.Discovery was successful!Hostname: testos01.xzxj.edu.cnRealm: XZXJ.EDU.CNDNS Domain: xzxj.edu.cnIPA Server: ipa.xzxj.edu.cnBaseDN: dc=xzxj,dc=edu,dc=cnContinue to configure the system with these values? [no]: yesSynchronizing time with KDC...Unable to sync time with IPA NTP server, assuming the time is in sync. Please check that 123 UDP port is opened.Password for admin@XZXJ.EDU.CN:Successfully retrieved CA cert    Subject:     CN=Certificate Authority,O=XZXJ.EDU.CN    Issuer:      CN=Certificate Authority,O=XZXJ.EDU.CN    Valid From:  Fri May 16 20:13:21 2014 UTC    Valid Until: Tue May 16 20:13:21 2034 UTCEnrolled in IPA realm XZXJ.EDU.CNCreated /etc/ipa/default.confNew SSSD config will be createdConfigured /etc/sssd/sssd.confConfigured /etc/krb5.conf for IPA realm XZXJ.EDU.CNtrying https://ipa.xzxj.edu.cn/ipa/xmlForwarding 'env' to server u'https://ipa.xzxj.edu.cn/ipa/xml'Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pubAdding SSH public key from /etc/ssh/ssh_host_dsa_key.pubForwarding 'host_mod' to server u'https://ipa.xzxj.edu.cn/ipa/xml'Could not update DNS SSHFP records.SSSD enabledConfigured /etc/openldap/ldap.confNTP enabledConfigured /etc/ssh/ssh_configConfigured /etc/ssh/sshd_configClient configuration complete.Test

Testing the login

[root@ipa ~]# ssh 172.16.255.151 -l candoncandon@172.16.255.151's password:Password expired. Change your password now.Kickstarted on 2014-05-01WARNING: Your password has expired.You must change your password now and login again!Changing password for user candon.Current Password:New password:Retype new password:passwd: all authentication tokens updated successfully.[root@ipa ~]# ssh 172.16.255.151 -l candoncandon@172.16.255.151's password:-bash-4.1$

Configure RHEVM by redhat-manage-domains command

[root@rhevm ~]# rhevm-manage-domains -action=add -addPermissions -domain=xzxj.edu.cn -user=admin -interactive -provider=IPAEnter password:Successfully added domain xzxj.edu.cn. oVirt Engine restart is required in order for the changes to take place (service ovirt-engine restart).Manage Domains completed successfully[root@rhevm ~]# service ovirt-engine restartStopping oVirt Engine:                                     [  OK  ]Starting oVirt Engine:                                     [  OK  ]

Lists the current configuration

[root@rhevm ~]# rhevm-manage-domains -action=listDomain: xzxj.edu.cn        User name: admin@XZXJ.EDU.CNManage Domains completed successfully

Login in rhevm web interface by user admin@xzxj.edu.cn