FreeIPA-users November 2025

freeipa-users@lists.fedorahosted.org

15 participants
24 discussions

EL9 IPA servers hanging on shutdown
by Orion Poplawski 25 Aug '26

25 Aug '26

We're seeing our EL9 IPA server VMs get stuck often at: A stop job is running for Identity, Policy, Audit Is anyone else seeing this? How can I avoid it? -- Orion Poplawski he/him/his - surely the least important thing about me IT Systems Manager 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

2 2

Best way to upgrade FreeIpa version and OS
by Youssef CHTOUROU 27 Jul '26

27 Jul '26

Hello I've 3 FreeIpa Servers (version =4.6.8) runned on Centos 7. I'am looking for upgrade these servers like that : Centos 7 to Rocky 8 FreeIpa server to most recent version possible I would like to see your advice : what is the best / secure way to do this upgrade ? Thanks a lot

2 1

Authenticate users with yubikeys without importing the certificate in IPA does not work.
by Theodor Vallier 23 Apr '26

23 Apr '26

Hello, I'm trying to allow authentication using Yubikeys on clients without importing user's certificates in idM. I use an external PKI that signs everything, so I have the root CA and one sub CA named piv that signs users' csr (that are stored in yubikeys). On the server, the output of ipa-advise config-server-for-smart-card-auth is executed and the output of ipa-advise config-client-for-smart-card-auth is also executed on the client. I added both the certificate mapping rule and the certificate mapping data (Issuer and subject) according to red hat documentation. Steps to Reproduce: In an internet forbidden environment, using at least three VMs on RHEL9. One for IPA, one as a workstation and one that will be the DHCP, DNS and NTP server. Once the DNS and DHCP are configured, I generated a root CA and two sub CAs, one for signing users csr (piv) and one for signing everything else (like ipa). Once ipa is installed with an external ca, I executed the output of ipa-advise config-server-for-smart-card-auth to load and configure ipa for smartcard. Then I added the Certificate Identity Mapping Rule: Mapping rule: (ipacertmapdata=X509:<I\>{issuer\_dn!nss\_x500}<S>{subject_dn!nss_x500}) Matching rule: <ISSUER>CN=piv,C=FR Once the client is registered in ipa, I executed the output of ipa-advise config-client-for-smart-card-auth to load and configure the client for smartcard. Then, I registered a new user, with pkinit enable and I created a Certificate mapping data for him with the good Subject and the same Issuer as the Certificate Identity Mapping Rule. Finally, I set up the yubikey for the corresponding user using the PKI and signed his certificate with the piv CA. Actual behavior: If the user certificate is not present in ipa, I'm prompted to enter the PIN CODE (the Yubikey is recognized and the user is automatically selected), but then I have the error "Sorry, smart card authentication didn't work, please try again". On ipa server, if I use the command ipa certmap-match <user-certificate>, no users are found. Furthermore, in sssd I can see that the server is trying to find a user with the certificate stored on the yubikey instead of trying to check if the certificate is valid and signed by the piv sub CA. Expected behavior: I would expect to be logged in. Version/Release/Distribution: ipa-server-4.10.1-9.el9_2.x86_64 ipa-client-4.10.1-9.el9_2.x86_64 389-ds-base-2.2.4-5.el9_2.x86_64 krb5-server-1.20.1-9.el9_2.x86_64 sssd-2.8.2-3.el9_2.x86_64 Additional info: I can provide more logs if necessary but don't know which ones you could want. Thanks Whidix

3 4

Authentication failure using FreeIPA with Debian13
by kev dog 30 Mar '26

30 Mar '26

Thanks for any help. I'm using Debian 13 Trixie within a Proxmox LXC as a FreeIPA client. My FreeIPA server is run on Fedora 42. My IPA server version is VERSION: 4.12.5, API_VERSION: 2.254. I went through setting up freeipa-client on Debian. I have a working Arch Linux installation as another freeipa client and I compared a lot of the configuration with krb5.conf and sssd.conf to the working configuration. After working through the installation if I try to login as a FreeIPA user I get the following: $ su jax Password: su: Authentication failure At first glance I thought this immediately as a error related to PAM, however I checked the PAM modules files and found I have the following: $grep -R sss /etc/pam.d/ /etc/pam.d/common-session:session optional pam_sss.so /etc/pam.d/common-account:account [default=bad success=ok user_unknown=ignore] pam_sss.so /etc/pam.d/common-password:password sufficient pam_sss.so use_authtok /etc/pam.d/common-auth:auth [success=1 default=ignore] pam_sss.so use_first_pass My arch linux pam.d files were a lot different so I really couldn't compare the structure. I've confirmed I get a kerberos ticket issued for my pam user: $ kinit jax Password for jax@<DOMAIN>.COM: $ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: jax@<DOMAIN>.COM Valid starting Expires Service principal 10/19/2025 00:08:10 10/19/2025 23:53:28 krbtgt/DOMAIN(a)DOMAIN.COM I'm not sure where to look as journalctl isn't exactly helpful: $ sudo journalctl -g pam -b ... Oct 18 23:46:37 traefik.domain.com su[520]: pam_unix(su:auth): authentication failure; logname=kevdog uid=1000 euid=0 tty=/dev/pts/3 ruser=kevdog rhost= user=jax Oct 18 23:46:37 traefik.domain.com su[520]: pam_sss(su:auth): authentication failure; logname=kevdog uid=1000 euid=0 tty=/dev/pts/3 ruser=kevdog rhost= user=jax Oct 18 23:46:37 traefik.domain.com su[520]: pam_sss(su:auth): received for user jax: 4 (System error) For reference my sssd.conf if below: [domain/domain.com] id_provider = ipa ipa_server = ipa.domain.com ipa_domain = domain.com ipa_hostname = traefik.domain.com sudo_provider = ipa auth_provider = ipa chpass_provider = ipa access_provider = permit cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt krb5_store_password_if_offline = True ldap_schema = ipa ldap_group_member = member enumerate = True default_shell = /usr/bin/bash use_fully_qualified_names = False fallback_homedir = /home/%u [sssd] services = nss, pam, ssh, sudo domains = domain.com [nss] homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp] [session_recording]

3 2

HTTP returns non-2xx status code
by Tania Hagan 26 Jan '26

26 Jan '26

Hi freeipa-users, We're currently using Freeipa version 4.11.0 on Rocky 9.4 with Apache/2.4.57 and every so often our HTTP fails with our monitoring returning non-2xx status code. Looking at the error log for httpd I see: [mpm_event:error] [pid 1800:tid 1800] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase ServerLimit. Researching this error, it appears to recommend adding to the httpd configuration https://forum.directadmin.com/threads/ah03490-scoreboard-is-full-note-at-ma…. Has anyone had to do this or can recommend a "freeipa" way to resolve this? (Reluctant to mess around with the httpd configuration as unsure on the effects of the client connections with freeipa) Many Thanks, Tania

3 6

DNSSEC - File.cpp(94): Could not open the file
by lejeczek 18 Dec '25

18 Dec '25

Hi guys When I sign a zone I get lots of: ... File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/26365760-a70d-19be-2db1-a80adc796477.object File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/9776a26e-2ad9-1b46-b65c-11265eee7fbd.object File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/9776a26e-2ad9-1b46-b65c-11265eee7fbd.object zone private.road/IN (signed): sending notifies (serial 1642004083) client @0x7f8f7c1948b8 10.3.1.99#39887: received notify for zone 'private.road' Are those a reason to worry & investigate? If not then what do they translate to? many thanks, L

3 5

last login info
by Dmitry Krasov 12 Dec '25

12 Dec '25

Hello. How to get last freeipa user's login info? There is no this info in web ui or from user-find command

4 12

dns response policy - something IPA can do?
by lejeczek 01 Dec '25

01 Dec '25

Hi guys. As per the subject - ideally with IPA's toolkit, within IPA, as opposed to tinkering with *bind* directly. thanks, L.

3 3

dirsrv failure to startup
by Peter Larsen 01 Dec '25

01 Dec '25

After having seen a lot of SERVFAIL for named-pkcs11 resolutions (resulting in a very slow name resolution) I choose to restart all services to start debugging from a clean state. Well, careful what you wish for. Dirsrv no longer starts, and the errors I see begin with: INFO - bdb_start - Resizing db cache size: 161433681 -> 161433517 ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. ERR - memberof-plugin - memberof_config - Error 53: The ipaOwner configuration attribute must be set to an attribute defined to use either the Distinguished Name or Name and Optional UID syntax. (illegal value: memberOfGroupAttr) ERR - memberof-plugin - memberof_postop_start - Configuration failed (Server is unwilling to perform) ERR - plugin_dependency_startall - Failed to start betxnpostoperation plugin MemberOf Plugin ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! ====== The last update was to enable dnssec on the server. That seems to have worked fine, ods have been creating/updating keys as expected. I then see a lot of WARN about key dn's missing: WARN - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=domain,dc=tld So reading/consistency of the opened files is definitely not working. This is followed by ERR - NSACLPlugin - __aclp__init_targetattr - targetattr "ipapwddictcheck" does not exist in schema. Please add attributeTypes "ipapwddictcheck" to schema if necessary. I feel like the best way forward is to grab a copy of a replica and start from there, Before I do that, I would love to understand what may be missing, because of it cannot "decrypt" the ldap, I'm not sure what a new copy requiring the same encryption would do? This is the version running. Name : ipa-server Version : 4.9.13 Release : 18.module+el8.10.0+23403+cc1f9b40 // Peter

2 2

Failed DNSSEC master - created new replica in cluster, how to promote to DNSSEC master?
by Peter Larsen 30 Nov '25

30 Nov '25

See $SUBJECT. When running "ipa-dns-instal --dnssec-master" it failures saying "DNSSEC key master(s): <ipa server> Only one DNSSEC key master is supported ..." The problem is that the server marked as DNSSEC master is failed, and (see other post) will not start dirsrv with what looks like a corruption in some files. I tried for quite a while to find a solution to recover the old replica, but I gave up. It's still "as is" but I hope to transfer it's responsibilities including DNSSEC to a new server before removing the old failed one. Hopefully someone has a link that documents this. All I find seems to insist I need to create a new DNSSEC master node first. I guess I can do that only if I totally remove the old failed server first. The key is that I cannot run any ipa-dns-commands on it, nor ipa-server commands - nothing is running, dirsrv fails starting right after the daemon is loaded but it then goes into a loop of not being able to find key DNs like hosts, users etc. Thanks!

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2025