FreeIPA-users December 2025

freeipa-users@lists.fedorahosted.org

19 participants
19 discussions

C/C++ API beyond PAM in case of dealing with expired passwords
by Frank Bergmann 19 Dec '25

19 Dec '25

Hi list, authenticating users via PAM API is very simple. But I'm struggling with expired passwords. Which C/C++ API/Lib can be used to handle an expired password? (e.g. providing old and new password and submit them to get a non-expired account) Can you please provide some links to related docs? I didn't find something related - just CLI hints. cheers, Frank

3 4

DNSSEC - File.cpp(94): Could not open the file
by lejeczek 18 Dec '25

18 Dec '25

Hi guys When I sign a zone I get lots of: ... File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/26365760-a70d-19be-2db1-a80adc796477.object File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/9776a26e-2ad9-1b46-b65c-11265eee7fbd.object File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/9776a26e-2ad9-1b46-b65c-11265eee7fbd.object zone private.road/IN (signed): sending notifies (serial 1642004083) client @0x7f8f7c1948b8 10.3.1.99#39887: received notify for zone 'private.road' Are those a reason to worry & investigate? If not then what do they translate to? many thanks, L

3 5

How do you keep DNS and ips the same
by Kevin Vasko 18 Dec '25

18 Dec '25

What is the best practice for keeping your IPs for DNS servers the same through OS migrations? The RH articles for migrating from RHEL7/CentOS7 to a newer version of OS want you to do a flatten and reload. Migration basically is install new OS set up a new replica on new server OS. That basically forces a new IP on the new replica, and you decommission the old server. Do you just swap IPs? Can you simply just move the new server to the old decommissioned servers ip? Or do you have to do something special in IPA? We don’t want to change our DNS servers IPs on ever migration to a new OS version. How can we avoid changing it on every OS upgrade essentially? I think the DNS is easier, but in a similar fashion we want to keep “ipa.example.com” what is the best method of keeping that hostname pointed to the entire IPA cluster? Right now it’s an actual machine, which is bad (we know). But how can I set up the DNS to effectively round robin ipa.example.com to all of our ipa servers? TIA

1 0

Unable to complete cleanup and conversion...
by Eric Ashley 17 Dec '25

17 Dec '25

This is a follow-on to the thread titled: "Re: [Freeipa-users] FreeIP 4.12.5-2-fc42 missing dse.ldif" After dsctl was updated to guard against the double close of the bdb source database, I now get the following error when trying to start IPA. ``` # ipactl start IPA version error: data needs to be upgraded (expected version '4.12.5-3.fc43', current version '4.12.5-3.fc42') Automatically running upgrade, for details see /var/log/ipaupgrade.log Be patient, this may take a few minutes. Automatic upgrade failed: DN: cn=Schema Compatibility,cn=plugins,cn=config does not exists or haven't been updated Upgrade failed with '' DN: cn=Schema Compatibility,cn=plugins,cn=config does not exists or haven't been updated IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. ('IPA upgrade failed.', 1) The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information See the upgrade log for more details and/or run /usr/sbin/ipa-server-upgrade again Aborting ipactl ``` I had to manually touch empty files in /var/lib/dirsrv/slapd-IPA-EXAMPLE-COM/ldif/ to get dsctl to complete correctly(ish): __dblib-changelog.ldif, __dblib-ipaca.ldif and __dblib-userroot.ldif. Nothing was actually written into any of these file, but with them extant it did complete without error. I'm still receiving this error now, with the latest versions of all F43 updates code: ``` 2025-12-15T20:30:35Z ERROR Upgrade failed with '' 2025-12-15T20:30:35Z ERROR DN: cn=Schema Compatibility,cn=plugins,cn=config does not exists or haven't been updated 2025-12-15T20:30:35Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. ```Of course, the only reference I can see to this error was a fix 7 years ago. How do I get my IPA back online? Best regards, Eric

2 1

dns question for migration from centos7
by Kevin Vasko 13 Dec '25

13 Dec '25

We have an old 3-way replica on CentOS7 that we need to upgrade. The servers are running DNS ipa1.tx.example.com - 192.168.10.10 ipa2.tx.example.com - 192.168.10.11 ipa3.tx.example.com - 192.168. 10.12 Since these are old and outdated OS I get the general idea of the “migration”. Install Rocky8, enroll into domain, decommission old machine, rinse repeat for the other 2. The part i’m unsure on is how do you deal with changing to DNS server ips. Our clients are all using 192.168.10.10, 192.168.10.11 for DNS. If I add another replica, it’s going to have to be on a different IP. So how do I deal with this migration moving the IP to the new server? Is it just as easy as decommissioning old server, and changing the new Rocky8 replica to the old 192.168.10.10 IP? I figure this will break everything…so how do you deal with this? What is the long term solution for this because I’m going to constantly have this same stupid problem for every major release since RHEL doesn’t support in place major release upgrades? (i’m planning to upgrade to Rocky9 at least as well in this process to get caught up, but not explaining it all for succinctness. -Kevin

1 0

last login info
by Dmitry Krasov 12 Dec '25

12 Dec '25

Hello. How to get last freeipa user's login info? There is no this info in web ui or from user-find command

4 12

FreeIPA 4.13.0
by Antonio Torres 05 Dec '25

05 Dec '25

The FreeIPA team would like to announce the FreeIPA 4.13.0 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. Full release notes are available at: https://www.freeipa.org/release-notes/4-13-0.html

1 0

dns response policy - something IPA can do?
by lejeczek 01 Dec '25

01 Dec '25

Hi guys. As per the subject - ideally with IPA's toolkit, within IPA, as opposed to tinkering with *bind* directly. thanks, L.

3 3

dirsrv failure to startup
by Peter Larsen 01 Dec '25

01 Dec '25

After having seen a lot of SERVFAIL for named-pkcs11 resolutions (resulting in a very slow name resolution) I choose to restart all services to start debugging from a clean state. Well, careful what you wish for. Dirsrv no longer starts, and the errors I see begin with: INFO - bdb_start - Resizing db cache size: 161433681 -> 161433517 ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. ERR - memberof-plugin - memberof_config - Error 53: The ipaOwner configuration attribute must be set to an attribute defined to use either the Distinguished Name or Name and Optional UID syntax. (illegal value: memberOfGroupAttr) ERR - memberof-plugin - memberof_postop_start - Configuration failed (Server is unwilling to perform) ERR - plugin_dependency_startall - Failed to start betxnpostoperation plugin MemberOf Plugin ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! ====== The last update was to enable dnssec on the server. That seems to have worked fine, ods have been creating/updating keys as expected. I then see a lot of WARN about key dn's missing: WARN - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=domain,dc=tld So reading/consistency of the opened files is definitely not working. This is followed by ERR - NSACLPlugin - __aclp__init_targetattr - targetattr "ipapwddictcheck" does not exist in schema. Please add attributeTypes "ipapwddictcheck" to schema if necessary. I feel like the best way forward is to grab a copy of a replica and start from there, Before I do that, I would love to understand what may be missing, because of it cannot "decrypt" the ldap, I'm not sure what a new copy requiring the same encryption would do? This is the version running. Name : ipa-server Version : 4.9.13 Release : 18.module+el8.10.0+23403+cc1f9b40 // Peter

2 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users December 2025