Differences between two replication agreements in freeIPA

Question

I am back from freeIPA replication documentation you can find here https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/identity_management_guide/ipa-replica-manage

I totally understand the directions of replication however in the picture there are two replication agreements specified

1. between Directory server
2. between Certificate system

It can be also seen in the Topology tab in web GUI where one or another can be defined, in other words, you can replicate only directory server on one node and only certificate system on another node.

After adding third server to my cluster I was unable to add user on it and it turned out, it had replication of DS to server1 and replication of certificate system to server2. When I added missing replication agreements everything started working as a charm.

The documentation site I pasted does not mention anything about these to so my question is, what exactly these replications do and what are consideration and benefits of having just one of them to the node.

Answer 1

The LDAP Directory is the main component in IPA, this is where all your users, groups, hosts, services etc. are stored. So when you create a replica, you want to sychronize all this data. So that if you make a change on one IPA server, it gets replicated to all the others. This is what the Directory replication does.

Certification Authority, on the other hand, is an optional component. You don't have to run CA on each replica that you have. But you do want to run it at least on two of the IPA servers in your domain, for redundancy purposes. And so, between those two IPA servers you will need the CA replication, to synchronize all the CA-related data (keys, generated certificates info, profiles etc).

So, simply put, CA replication is for the CA component, and Directory replication is for the rest.

When you install a replica, it will automatically create Directory replication and - if you install CA on it - also CA replication. After the installation, you can add more replication agreements, to build some kind of redundant replication topology between all your IPA servers. For example, imagine that you have three IPA servers. You have Directory replication S1-S2 and S2-S3. If S2 goes down, then your other two servers become isolated. Now if you make a change on S1, it will not be replicated to S3. But if you would add one more replication agreement S1-S3, you would not have this problem.