Currently the patches being developed to include a DRM into IPA presuppose the installation of a Dogtag CA. That Dogtag CA is used to generate the required system certificates. In addition, a connector is automatically set up between the CA and KRA to allow the escrow of encryption keys for user certs,

There is, however, a DRM option that does not include a Dogtag CA. This standalone KRA would obtain its system certificates from an external CA and would be used only for vault like functionality -- ie. the storage and retrieval of secrets.

This ticket is an RFE for the code changes needed to allow a standalone DRM to be installed on a non Dogtag CA IPA instance.