FreeIPA-users February 2025

freeipa-users@lists.fedorahosted.org

31 participants
43 discussions

choosing auth indicator
by Charles Hedrick 04 Feb '25

04 Feb '25

We will have two external radius services, one which uses OTP and one which doesn't. As far as I can tell, IPA uses a radius auth indicator for all radius servers. Is there a way to set up one service to set the OTP indicator or its own unique indicator?

2 1

New error messages with EL9
by Orion Poplawski 03 Feb '25

03 Feb '25

We recently updated all 6 of our IPA replicas to EL9 and so we're monitoring them closely for any issues. I've seen the following message in the slapd errors log a couple of times on different servers and am wondering if it is anything to be concerned about: [02/Feb/2025:20:27:54.176404718 -0700] - WARN - content-sync-plugin - sync_update_persist_betxn_pre_op - DB retried operation targets "dc=nwra,dc=com" (op=0x7f840be70e00 idx_pl=0) => op not changed in PL [02/Feb/2025:20:57:56.553507369 -0700] - ERR - decode_repl_ext_response - decoding failed: response_code (Ok) ruv_bervals (Ok) data_guid (Ok) data (Ok) bvdata (No data) [02/Feb/2025:20:57:56.555181048 -0700] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=IPA2-IPA1" (IPA1:389): Unable to parse the response to the endReplication extended operation. Thanks, Orion -- Orion Poplawski he/him/his - surely the least important thing about me IT Systems Manager 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

1 0

slave replica's DNS to forward first to master replica?
by Brian J. Murrell 01 Feb '25

01 Feb '25

Is there any supported configuration that instructs a slave replica to first forward DNS queries to the master replica's DNS server and only if it is down, to try to resolve recursively on it's own? The goal here is to leverage the cache of the master replica to reduce outbound queries from the slave replica. Ultimately, I want the slave replica to be as quiet/unloaded as possible and only really be used in the case of the master replica being down, if that helps the context any. This is for a small slave host in a very small network -- one where even a single replica is more than enough to satisfy the clients, but just looking to add redundancy and major version O/S upgrade paths (since FreeIPA cannot do in-place upgrades on EL and must use a replica to replicate from one the O/S major version upgrade is done -- assuming that is still the state of FreeIPA's in-place upgrade limitations -- on EL8 at least). Cheers, b.

3 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users February 2025