FreeIPA-users December 2025

freeipa-users@lists.fedorahosted.org

19 participants
19 discussions

EL9 IPA servers hanging on shutdown
by Orion Poplawski 25 Aug '26

25 Aug '26

We're seeing our EL9 IPA server VMs get stuck often at: A stop job is running for Identity, Policy, Audit Is anyone else seeing this? How can I avoid it? -- Orion Poplawski he/him/his - surely the least important thing about me IT Systems Manager 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

2 2

Best way to upgrade FreeIpa version and OS
by Youssef CHTOUROU 26 Jul '26

26 Jul '26

Hello I've 3 FreeIpa Servers (version =4.6.8) runned on Centos 7. I'am looking for upgrade these servers like that : Centos 7 to Rocky 8 FreeIpa server to most recent version possible I would like to see your advice : what is the best / secure way to do this upgrade ? Thanks a lot

2 1

Authenticate users with yubikeys without importing the certificate in IPA does not work.
by Theodor Vallier 23 Apr '26

23 Apr '26

Hello, I'm trying to allow authentication using Yubikeys on clients without importing user's certificates in idM. I use an external PKI that signs everything, so I have the root CA and one sub CA named piv that signs users' csr (that are stored in yubikeys). On the server, the output of ipa-advise config-server-for-smart-card-auth is executed and the output of ipa-advise config-client-for-smart-card-auth is also executed on the client. I added both the certificate mapping rule and the certificate mapping data (Issuer and subject) according to red hat documentation. Steps to Reproduce: In an internet forbidden environment, using at least three VMs on RHEL9. One for IPA, one as a workstation and one that will be the DHCP, DNS and NTP server. Once the DNS and DHCP are configured, I generated a root CA and two sub CAs, one for signing users csr (piv) and one for signing everything else (like ipa). Once ipa is installed with an external ca, I executed the output of ipa-advise config-server-for-smart-card-auth to load and configure ipa for smartcard. Then I added the Certificate Identity Mapping Rule: Mapping rule: (ipacertmapdata=X509:<I\>{issuer\_dn!nss\_x500}<S>{subject_dn!nss_x500}) Matching rule: <ISSUER>CN=piv,C=FR Once the client is registered in ipa, I executed the output of ipa-advise config-client-for-smart-card-auth to load and configure the client for smartcard. Then, I registered a new user, with pkinit enable and I created a Certificate mapping data for him with the good Subject and the same Issuer as the Certificate Identity Mapping Rule. Finally, I set up the yubikey for the corresponding user using the PKI and signed his certificate with the piv CA. Actual behavior: If the user certificate is not present in ipa, I'm prompted to enter the PIN CODE (the Yubikey is recognized and the user is automatically selected), but then I have the error "Sorry, smart card authentication didn't work, please try again". On ipa server, if I use the command ipa certmap-match <user-certificate>, no users are found. Furthermore, in sssd I can see that the server is trying to find a user with the certificate stored on the yubikey instead of trying to check if the certificate is valid and signed by the piv sub CA. Expected behavior: I would expect to be logged in. Version/Release/Distribution: ipa-server-4.10.1-9.el9_2.x86_64 ipa-client-4.10.1-9.el9_2.x86_64 389-ds-base-2.2.4-5.el9_2.x86_64 krb5-server-1.20.1-9.el9_2.x86_64 sssd-2.8.2-3.el9_2.x86_64 Additional info: I can provide more logs if necessary but don't know which ones you could want. Thanks Whidix

3 4

Authentication failure using FreeIPA with Debian13
by kev dog 30 Mar '26

30 Mar '26

Thanks for any help. I'm using Debian 13 Trixie within a Proxmox LXC as a FreeIPA client. My FreeIPA server is run on Fedora 42. My IPA server version is VERSION: 4.12.5, API_VERSION: 2.254. I went through setting up freeipa-client on Debian. I have a working Arch Linux installation as another freeipa client and I compared a lot of the configuration with krb5.conf and sssd.conf to the working configuration. After working through the installation if I try to login as a FreeIPA user I get the following: $ su jax Password: su: Authentication failure At first glance I thought this immediately as a error related to PAM, however I checked the PAM modules files and found I have the following: $grep -R sss /etc/pam.d/ /etc/pam.d/common-session:session optional pam_sss.so /etc/pam.d/common-account:account [default=bad success=ok user_unknown=ignore] pam_sss.so /etc/pam.d/common-password:password sufficient pam_sss.so use_authtok /etc/pam.d/common-auth:auth [success=1 default=ignore] pam_sss.so use_first_pass My arch linux pam.d files were a lot different so I really couldn't compare the structure. I've confirmed I get a kerberos ticket issued for my pam user: $ kinit jax Password for jax@<DOMAIN>.COM: $ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: jax@<DOMAIN>.COM Valid starting Expires Service principal 10/19/2025 00:08:10 10/19/2025 23:53:28 krbtgt/DOMAIN(a)DOMAIN.COM I'm not sure where to look as journalctl isn't exactly helpful: $ sudo journalctl -g pam -b ... Oct 18 23:46:37 traefik.domain.com su[520]: pam_unix(su:auth): authentication failure; logname=kevdog uid=1000 euid=0 tty=/dev/pts/3 ruser=kevdog rhost= user=jax Oct 18 23:46:37 traefik.domain.com su[520]: pam_sss(su:auth): authentication failure; logname=kevdog uid=1000 euid=0 tty=/dev/pts/3 ruser=kevdog rhost= user=jax Oct 18 23:46:37 traefik.domain.com su[520]: pam_sss(su:auth): received for user jax: 4 (System error) For reference my sssd.conf if below: [domain/domain.com] id_provider = ipa ipa_server = ipa.domain.com ipa_domain = domain.com ipa_hostname = traefik.domain.com sudo_provider = ipa auth_provider = ipa chpass_provider = ipa access_provider = permit cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt krb5_store_password_if_offline = True ldap_schema = ipa ldap_group_member = member enumerate = True default_shell = /usr/bin/bash use_fully_qualified_names = False fallback_homedir = /home/%u [sssd] services = nss, pam, ssh, sudo domains = domain.com [nss] homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp] [session_recording]

3 2

HTTP returns non-2xx status code
by Tania Hagan 26 Jan '26

26 Jan '26

Hi freeipa-users, We're currently using Freeipa version 4.11.0 on Rocky 9.4 with Apache/2.4.57 and every so often our HTTP fails with our monitoring returning non-2xx status code. Looking at the error log for httpd I see: [mpm_event:error] [pid 1800:tid 1800] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase ServerLimit. Researching this error, it appears to recommend adding to the httpd configuration https://forum.directadmin.com/threads/ah03490-scoreboard-is-full-note-at-ma…. Has anyone had to do this or can recommend a "freeipa" way to resolve this? (Reluctant to mess around with the httpd configuration as unsure on the effects of the client connections with freeipa) Many Thanks, Tania

3 6

Dynamic control of plugin loading (backend and frontend)
by Данила Скачедубов 29 Dec '25

29 Dec '25

3 4

IPA users/groups are gone after a second reboot
by G H 26 Dec '25

26 Dec '25

I noticed that the web GUI and `ipa user-find` returned zero users after I migrated my FreeIPA VM to a different hypervisor. So I turned the original VM on and the problem persisted. I then restored from a backup from a week ago on the original hypervisor and the users are back. But then if I reboot that restored VM, the users are gone again. When I do an ldapsearch for users, I can find them; so I think the 389 DB is functional. It seems to be something with the JSON API. I have tried with the admin user and a non-admin user, but with admin rights. How can I begin to debug this?

2 1

getting rid of defunct ipa server
by ether bunny 23 Dec '25

23 Dec '25

I thought I'd scrubbed out the old freeipa server (replaced by 2 shiny new ones) but I keep seeing references to it in /var/log/krb5kdc.log on one of the new ipa servers. freeipa-a krb5kdc[959452](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), UNSUPPORTED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19)}) 10.95.96.52: CLIENT_NOT_FOUND: host/freeipa.domain@DOMAIN for krbtgt/DOMAIN@DOMAIN, Client not found in Kerberos database Its not clear from this message what client/service is still pointing at the old host. If I do 'ipa-replica-manage dnarange-show' - all I see are the 2 new replicas 'ipa config-show | grep "CA renewal master"' - shows the new host Where else should I be looking?

1 1

Re: Unable to complete cleanup and conversion...
by Eric Ashley 22 Dec '25

22 Dec '25

Hi Florence, It exists in the file as "dn: cn=schema compatibility,cm=plugins,cn=config". Is there a case sensitive test occurring somewhere? I think the errors are occurring on the entries that still include "cn=ldbm". I think they should be "cn=mdb" now, but I'm not sure. Should I change them as such? I've attached ipaupgrade.log and the journal entries for the failure. dse.ldif is too large for the list, so it's available here: https://drive.proton.me/urls/2CMCHCM520#PUqS5gw5wemZ Best regards, Eric Dec 17, 2025, 18:41 by eric(a)ab-data.us: > Hi Florence, > > It exists in the file as "dn: cn=schema compatibility,cm=plugins,cn=config". Is there a case sensitive test occurring somewhere? > > I think the errors are occurring on the entries that still include "cn=ldbm". I think they should be "cn=mdb" now, but I'm not sure. Should I change them as such? > > I've attached dse.ldif, ipaupgrade.log and the journal entries for the failure. > > Best regards, > Eric > > Dec 17, 2025, 04:37 by flo(a)redhat.com: > >> Hi, >> >> in the file /etc/dirsrv/slapd-IPA-EXAMPLE-COM/dse.ldif, do you have an entry with "dn: cn=Schema Compatibility,cn=plugins,cn=config" ? >> Could you post the content of /var/log/ipaupgrade.log and dse.ldif? >> >> flo >> >> On Mon, Dec 15, 2025 at 10:16 PM Eric Ashley via FreeIPA-users <>> freeipa-users(a)lists.fedorahosted.org>> > wrote: >> >>> This is a follow-on to the thread titled: "Re: [Freeipa-users] FreeIP 4.12.5-2-fc42 missing dse.ldif" >>> >>> After dsctl was updated to guard against the double close of the bdb source database, I now get the following error when trying to start IPA. >>> >>> ``` >>> # ipactl start >>> IPA version error: data needs to be upgraded (expected version '4.12.5-3.fc43', current version '4.12.5-3.fc42') >>> Automatically running upgrade, for details see /var/log/ipaupgrade.log >>> Be patient, this may take a few minutes. >>> Automatic upgrade failed: DN: cn=Schema Compatibility,cn=plugins,cn=config does not exists or haven't been updated >>> Upgrade failed with '' >>> DN: cn=Schema Compatibility,cn=plugins,cn=config does not exists or haven't been updated >>> IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. >>> ('IPA upgrade failed.', 1) >>> The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information >>> >>> See the upgrade log for more details and/or run /usr/sbin/ipa-server-upgrade again >>> Aborting ipactl >>> ``` >>> I had to manually touch empty files in /var/lib/dirsrv/slapd-IPA-EXAMPLE-COM/ldif/ to get dsctl to complete correctly(ish): __dblib-changelog.ldif, __dblib-ipaca.ldif and __dblib-userroot.ldif. Nothing was actually written into any of these file, but with them extant it did complete without error. >>> I'm still receiving this error now, with the latest versions of all F43 updates code: >>> >>> ``` >>> 2025-12-15T20:30:35Z ERROR Upgrade failed with '' >>> 2025-12-15T20:30:35Z ERROR DN: cn=Schema Compatibility,cn=plugins,cn=config does not exists or haven't been updated >>> 2025-12-15T20:30:35Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. >>> ```Of course, the only reference I can see to this error was a fix 7 years ago. How do I get my IPA back online? >>> >>> Best regards, >>> Eric >>> -- >>> _______________________________________________ >>> FreeIPA-users mailing list -- >>> freeipa-users(a)lists.fedorahosted.org >>> To unsubscribe send an email to >>> freeipa-users-leave(a)lists.fedorahosted.org >>> Fedora Code of Conduct: >>> https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >>> List Guidelines: >>> https://fedoraproject.org/wiki/Mailing_list_guidelines >>> List Archives: >>> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… >>> Do not reply to spam, report it: >>> https://pagure.io/fedora-infrastructure/new_issue >>> > >

2 4

freeIPA federation with keycloak
by Vincent Bartro 22 Dec '25

22 Dec '25

Hello all, we are investigating the various options to create a federation between keycloak and freeIPA, where freeIPA is the central IdM. There seems to be two major options for such a federation : - have keycloak talk LDAPS to freeIPA - have keycloak talk Kerberos to freeIPA I could not find a clear and objective list of criteria to decide to pick one option over the other Did anybody already experience any of these two approached and could share their experience? Thanks a lot in advance Best regards

4 3

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users December 2025