freeipa

#5569 [RFE] Support Read-Only Replicas
Closed: wontfix by frenaud. Opened by pvoborni.

Closed: wontfix
Reopen Issue

Ticket was cloned from Red Hat Bugzilla (product Red Hat Enterprise Linux 7): Bug 1291240

Identity Management users with many sites requiring high availability would
need at least 1-2 IdM replicas per site. When the number of sites is higher
than 20-50, the number of IdM Master servers become too high and harder to
maintain. It would be better to deploy ~20 IdM master servers in the major
sites and then deploy Read Only replicas in other sites which won't require
write access.
Currently, IdM only supports only writable replicas and the high availability
is provided by these replicas + offline caching on the client (SSSD) side.
However, this does not cover situations when the connection to IdM master
server (in other side) is broken and admin needs to log in to a server he/she
never logged to.

Metadata Update from @pvoborni:
- Issue assigned to someone
- Issue set to the milestone: Future Releases

Another use-case:

Site may want to deploy IdM replicas in a DMZ for service to outside clients but are concerned about greater exposure to unwanted changes making it back into the organization.

If by "services" we mean Kerberos, it's possible to do that today by deploying kdcproxy: https://github.com/latchset/kdcproxy/

However, this won't get you other services.

Question: what would a solution to this look like?

Would it have to be a tweak to the replication code to make it one-way only?

Or might it be possible to do it via an export/transfer/reimport?

Please know that we carefully considered and evaluated your request and its potential impact on our product roadmap, market demand, and overall strategy.
While we understand that addressing enhancements, bugs, and issues is critical for ensuring the quality and reliability of our product, we need to balance these priorities with our long-term goals and resource constraints. Unfortunately, we cannot address this request at this time as it does not align with our product vision and strategy, and keeping it in the backlog would be misleading and give the false impression that we will address it in the future, thus we are closing it.
Thank you for understanding,

Metadata Update from @frenaud:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
Normal
enhancement
Replication
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.