Every server had local users. Now one directory, four replicas, and no shared root.
Identity & directory cluster (FreeIPA)
Where they started
Authentication was local accounts plus SSH keys distributed by hand. Nobody could produce a list of who had administrative access to what.
The problem, precisely
Consolidating identity touches every server, and a directory outage means nobody can log in — including the people fixing it.
What we did
Rolled out replicas first and left local accounts in place as break-glass, then migrated hosts in batches with a rollback path per batch, only removing local access at the end.
Delivered
- Four directory replicas across three sites with CA renewal automated
- Host enrolment via Ansible with a documented, reversible batch process
- Sudo and host-based access control centralised, with a per-team delegation model
- Break-glass local accounts retained under a documented control, not deleted casually
- Certificate lifecycle automated — the most common cause of certificate expiry outages
Technologies used
Measured result
Every number below was measured and reported to the customer. Where we do not have a measured figure, the entry is a fact rather than a percentage — we would rather be precise than impressive.
- 320 servers enrolled, no local admin accounts remaining
- 4 directory replicas across three sites
- 0 login outages during the batch rollout
- 1 authoritative answer to "who has root where"
Never remove the local break-glass account in the same change that introduces the directory. Identity migrations fail as availability incidents, not as authentication bugs.