From 29ad61a0b98d7d53fc49e8c5c2eb4e6214e119d6 Mon Sep 17 00:00:00 2001
From: Michal Konecny <mkonecny@redhat.com>
Date: Feb 14 2024 15:50:53 +0000
Subject: [PATCH 1/2] Add IPA SOP


Signed-off-by: Michal Konecny <mkonecny@redhat.com>

---

diff --git a/modules/sysadmin_guide/pages/index.adoc b/modules/sysadmin_guide/pages/index.adoc
index de0fe52..0a28e2e 100644
--- a/modules/sysadmin_guide/pages/index.adoc
+++ b/modules/sysadmin_guide/pages/index.adoc
@@ -123,6 +123,7 @@ xref:developer_guide:sops.adoc[Developing Standard Operating Procedures].
 * xref:infra-raidmismatch.adoc[Infrastructure Raid Mismatch Count]
 * xref:infra-repo.adoc[Infrastructure Yum Repo]
 * xref:infra-retiremachine.adoc[Infrastructure retire machine]
+* xref:ipa.adoc[IPA infrastructure]
 * xref:ipsilon.adoc[Ipsilon Infrastructure]
 * xref:iscsi.adoc[iSCSI]
 * xref:kerneltest-harness.adoc[Kerneltest-harness]
diff --git a/modules/sysadmin_guide/pages/ipa.adoc b/modules/sysadmin_guide/pages/ipa.adoc
new file mode 100644
index 0000000..94ebbb1
--- /dev/null
+++ b/modules/sysadmin_guide/pages/ipa.adoc
@@ -0,0 +1,56 @@
+= IPA Infrastructure SOP
+
+== Contact Information
+
+Owner::
+  Fedora Infrastructure Team
+
+Contact::
+  https://matrix.to/#/#admin:fedoraproject.org
+
+Primary upstream contact::
+  Alexander Bokovoy - FAS: abbra
+
+Servers::
+* ipa01.iad2.fedoraproject.org
+* ipa02.iad2.fedoraproject.org
+* ipa03.iad2.fedoraproject.org
+* ipa01.stg.iad2.fedoraproject.org
+* ipa02.stg.iad2.fedoraproject.org
+* ipa03.stg.iad2.fedoraproject.org
+
+URL::
+* link:https://id.fedoraproject.org/ipa/ui
+* link:https://id.stg.fedoraproject.org/ipa/ui
+
+Purpose::
+  IPA is used as Identity management server for Fedora users. It serves as backend for
+  Fedora Account System.
+
+== Description
+
+link:https://www.freeipa.org/[IPA] is used as a backend LDAP database for handling the
+user authentication inside Fedora Infrastructure.
+
+== Known issues
+
+Most issues regarding user data could be solved through web interface.
+
+== Restarting
+
+To restart the IPA service you simply need to ssh to any of the servers and issue an
+`ipactl restart`.
+
+== Configuration
+
+Configuration is handled by the
+link:https://pagure.io/fedora-infra/ansible/blob/5ad386ed6fb30484348848a354d4dfa6b7393f74/f/playbooks/groups/ipa.yml[ipa.yml]
+playbook in Ansible. This playbook could also be used to reconfigure application,
+if that becomes necessary.
+
+== Common actions
+
+This section describes some common actions done on IPA.
+
+* xref:howtos:groups_in_fedora.adoc#_how_to_create_a_group[Creating group]
+* xref:2-factor.adoc[Two factor authentication]

From 3d9af9f4e1bf839686c445ddc6af8f6eb74f9f8c Mon Sep 17 00:00:00 2001
From: Michal Konecny <mkonecny@redhat.com>
Date: Feb 15 2024 09:37:58 +0000
Subject: [PATCH 2/2] Add additional information


* Fix links syntax
* Add information about how to check status of the cluster
* Add info what to do if web UI redirects to internal name

Signed-off-by: Michal Konecny <mkonecny@redhat.com>

---

diff --git a/modules/sysadmin_guide/pages/ipa.adoc b/modules/sysadmin_guide/pages/ipa.adoc
index 94ebbb1..a65da4b 100644
--- a/modules/sysadmin_guide/pages/ipa.adoc
+++ b/modules/sysadmin_guide/pages/ipa.adoc
@@ -20,8 +20,8 @@ Servers::
 * ipa03.stg.iad2.fedoraproject.org
 
 URL::
-* link:https://id.fedoraproject.org/ipa/ui
-* link:https://id.stg.fedoraproject.org/ipa/ui
+* link:https://id.fedoraproject.org/ipa/ui[]
+* link:https://id.stg.fedoraproject.org/ipa/ui[]
 
 Purpose::
   IPA is used as Identity management server for Fedora users. It serves as backend for
@@ -36,6 +36,17 @@ user authentication inside Fedora Infrastructure.
 
 Most issues regarding user data could be solved through web interface.
 
+=== Web UI redirects to internal name
+
+If web UI starts redirecting to internal name instead of link:https://id.fedoraproject.org/ipa/ui[]
+you need to either run `ipa.yml` playbook or fix that in `/etc/httpd/conf.d/ipa-redirects.conf` on the
+machine that the redirection is going to.
+
+== Checking status
+
+To check status of IPA cluster you simply need to ssh to any of the servers and run
+`ipactl status`.
+
 == Restarting
 
 To restart the IPA service you simply need to ssh to any of the servers and issue an