FreeIPA-users April 2025

freeipa-users@lists.fedorahosted.org

32 participants
40 discussions

Re: freeIPA fails update 4.12.2-5.el9 t 4.12.2-9.el9
by Vicente Quintans 03 Jun '25

03 Jun '25

We found this issue today, upgrading from Fedora 40 to Fedora 41. In dogtagpki the /ca/rest/account/login endpoint (actually all /ca/rest endpoints) was moved to /ca/v1 in this commit: https://github.com/dogtagpki/pki/commit/850e6b9e5128264a471e57b70ab8d970cf9… We were able to complete the upgrade succesfully modifying the file /usr/lib/python3.13/site-packages/ipaserver/plugins/dogtag.py changing al "/rest" to "/v1". With this modification ipa-server-upgrade completed successfully. It seems there is some kind of version mismatch. Greetings, Vicente Quintáns.

10 35

FreeIPA failed after upgrading to fedora 42
by Ian Kumlien 09 May '25

09 May '25

Hi, I have two freeipa servers that failed after the upgrade. On one, i managed to fix it with ipa-cert-fix since they had expired again, but i'm now left with: ipa-backup Preparing backup on freeipa1.... Error: Local roles CA, DNS, DNSKeySync do not match globally used roles CA, DNS, DNSKeySync, KRA. A backup done on this host would not be complete enough to restore a fully functional, identical cluster. The ipa-backup command failed. See /var/log/ipabackup.log for more information And on the other pki-tomcat doesn't start without ca_signing.csr which it never had according to backups... Any clues?

3 10

Using OIDC device code auth for SSH access
by Anders Wittendorff 30 Apr '25

30 Apr '25

I'm currently stuck in an implementation of device code auth for SSH access using External Identity on FreeIPA 4.12. My issue is that when connecting with SSH I get the correct message: Authenticate at https://... with code and press Enter. But after authentication at external IDP and pressing Enter the login just loops, and when looking at logs on the FreeIPA server I can see the Access-Challenge but seems to shutdown the process: Apr 23 13:31:27 ipa-test.int.domain.net ipa-otpd[147396]: username(a)INT.DOMAIN.NET: response sent: Access-Challenge Apr 23 13:31:27 ipa-test.int.domain.net ipa-otpd[147396]: oauth2.c:089: Child finished with status [0]. Apr 23 13:31:27 ipa-test.int.domain.net ipa-otpd[147396]: Socket closed, shutting down... Any inputs?

2 9

CA-less conversion
by tipex tipex 28 Apr '25

28 Apr '25

I've recently had a lot of trouble with CA on my FreeIPA 2 node cluster. Some amazing people on this forum have helped me fix the issues but its got me thinking that I dont use CA as I have external certificates (LetsEncrypt) so could I get rid of it. Less stuff = less failures. I'm wondering if I could create two new machines (C and D) without CA installed and add them to the cluster. Then remove the two existing machines (A and B) which have CA installed. This way I remove CA but keep all my users and settings that are currently in FreeIPA. Does this sound feasible or am I asking for problems? Thanks

2 2

Fedora 41 to F42 system-upgrade errors out on tomcat CA login attempt
by Eric Ashley 24 Apr '25

24 Apr '25

Hello, I'm running the following new versions: |Installed packages freeipa-client.x86_64 4.12.2-13.fc42 updates freeipa-client-common.noarch 4.12.2-13.fc42 updates freeipa-common.noarch 4.12.2-13.fc42 updates freeipa-healthcheck.noarch 0.17-6.fc42 fedora freeipa-healthcheck-core.noarch 0.17-6.fc42 fedora freeipa-selinux.noarch 4.12.2-13.fc42 updates freeipa-server.x86_64 4.12.2-13.fc42 updates freeipa-server-common.noarch 4.12.2-13.fc42 updates freeipa-server-dns.noarch 4.12.2-13.fc42 updates libcamera-ipa.x86_64 0.4.0-4.fc42 fedora libipa_hbac.x86_64 2.10.2-3.fc42 fedora python3-ipaclient.noarch 4.12.2-13.fc42 updates|| ||python3-ipalib.noarch 4.12.2-13.fc42 updates| |ipactl status |reports the following: Directory Service: RUNNING krb5kdc Service: STOPPED kadmin Service: STOPPED named Service: STOPPED httpd Service: RUNNING ipa-custodia Service: STOPPED pki-tomcatd Service: RUNNING ipa-otpd Service: STOPPED ipa-ods-exporter Service: STOPPED ods-enforcerd Service: STOPPED ipa-dnskeysyncd Service: RUNNING 5 service(s) are not running On initial boot, the system started the FreeIPA upgrade, which got through all the certificate checks with no issues, then reports the following errors (with retry): |2025-04-17T18:43:18Z INFO [Ensuring presence of included profiles] 2025-04-17T18:43:18Z DEBUG Discovery: available servers for service 'CA' are phobos.ipa.ab-data.us 2025-04-17T18:43:18Z DEBUG Discovery: using phobos.ipa.ab-data.us for 'CA' service 2025-04-17T18:43:18Z DEBUG request GET https://phobos.ipa.ab-data.us:443/ca/rest/account/login 2025-04-17T18:43:18Z DEBUG request body '' 2025-04-17T18:43:18Z DEBUG response status 404 2025-04-17T18:43:18Z DEBUG response headers Date: Thu, 17 Apr 2025 18:43:18 GMT Server: Apache/2.4.63 (Fedora Linux) OpenSSL/3.2.4 mod_wsgi/5.0.2 Python/3.13 mod_auth_gssapi/1.6.5 Content-Type: text/html;charset=utf-8 Content-Language: en Transfer-Encoding: chunked 2025-04-17T18:43:18Z DEBUG response body (decoded): b'<!doctype html><html lang="en"><head><title>HTTP Status 404 \xe2\x80\x93 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 \xe2\x80\x93 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [/ca/rest/account/login] is not available</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.98</h3></body></html>' 2025-04-17T18:43:18Z DEBUG Overriding CA port: Failed to authenticate to CA REST API 2025-04-17T18:43:18Z DEBUG Profile 'KDCs_PKINIT_Certs' is already in LDAP; skipping 2025-04-17T18:43:18Z DEBUG Profile 'caIPAserviceCert' is already in LDAP; skipping 2025-04-17T18:43:18Z DEBUG Profile 'acmeIPAServerCert' is already in LDAP; skipping 2025-04-17T18:43:18Z DEBUG Profile 'IECUserRoles' is already in LDAP; skipping 2025-04-17T18:43:18Z INFO [Add default CA ACL] 2025-04-17T18:43:18Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state' 2025-04-17T18:43:18Z INFO Default CA ACL already added 2025-04-17T18:43:18Z DEBUG Loading StateFile from '/var/lib/ipa/sysupgrade/sysupgrade.state' 2025-04-17T18:43:18Z DEBUG Discovery: available servers for service 'CA' are phobos.ipa.ab-data.us 2025-04-17T18:43:18Z DEBUG Discovery: using phobos.ipa.ab-data.us for 'CA' service 2025-04-17T18:43:18Z DEBUG request GET https://phobos.ipa.ab-data.us:8443/ca/rest/account/login 2025-04-17T18:43:18Z DEBUG request body '' 2025-04-17T18:43:18Z DEBUG response status 404 2025-04-17T18:43:18Z DEBUG response headers Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 784 Date: Thu, 17 Apr 2025 18:43:18 GMT 2025-04-17T18:43:18Z DEBUG response body (decoded): b'<!doctype html><html lang="en"><head><title>HTTP Status 404 \xe2\x80\x93 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 \xe2\x80\x93 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [/ca/rest/account/login] is not available</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/9.0.98</h3></body></html>' 2025-04-17T18:43:18Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually. 2025-04-17T18:43:18Z DEBUG File "/usr/lib/python3.13/site-packages/ipapython/admintool.py", line 219, in execute return_value = self.run() File "/usr/lib/python3.13/site-packages/ipaserver/install/ipa_server_upgrade.py", line 54, in run server.upgrade() ~~~~~~~~~~~~~~^^ File "/usr/lib/python3.13/site-packages/ipaserver/install/server/upgrade.py", line 2097, in upgrade upgrade_configuration() ~~~~~~~~~~~~~~~~~~~~~^^ File "/usr/lib/python3.13/site-packages/ipaserver/install/server/upgrade.py", line 1958, in upgrade_configuration cainstance.repair_profile_caIPAserviceCert() ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^ File "/usr/lib/python3.13/site-packages/ipaserver/install/cainstance.py", line 2166, in repair_profile_caIPAserviceCert with api.Backend.ra_certprofile as profile_api: ^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.13/site-packages/ipaserver/plugins/dogtag.py", line 610, in __enter__ raise errors.RemoteRetrieveError(reason=_('Failed to authenticate to CA REST API')) 2025-04-17T18:43:18Z DEBUG The ipa-server-upgrade command failed, exception: RemoteRetrieveError: Failed to authenticate to CA REST API 2025-04-17T18:43:18Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details: RemoteRetrieveError: Failed to authenticate to CA REST API 2025-04-17T18:43:18Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information| Tomcat is active, all the certificates are current and in LDAP. I was unable to find anything similar in the archive. How to I go about getting this update to finish? Best regards, Eric

4 7

Integration AD and IPA for single auth point
by Fiodor Cibulin 24 Apr '25

24 Apr '25

Hi Everybody I need help with recommendation on integration of AD and IPA . Our target is to create an environment with single authentication credentials, while allow preserving user access configuration (sudo / HBAC ) and data permissions via groups independently. We have some Samba setups that need to get information from both systems so we added UID and GID information to AD objects . In our environment we have hundreds of lab desktops and portable devices running Ubuntu and RHEL based OS . While most of user personal devices are Windows based we have some users using Linux as well. I found following ways: Password sync service. My college used it previously and recommended it as solution, but it looks that this way is not under development recently and not recommended for new setups. AD - IPA domains trust. I tested trust between AD and IPA and stuck with issue that we were required to multiply user groups as were unable to get access/sudo without creating POSIX IPA groups . We are using NFS3 with 16 groups limit that significantly limiting us in how many POSIX groups user can be member of . IPA - AD via Radius with LDAP backend. I tested such setup and it was working correctly for online systems, but offline users were unable to login. Offline login is must for our setup as we have user laptops. All my attempts to find solution on this behaviour were not successful and even with Ubuntu 24 that includes SSSD 2.9 that intended to support FAST channel for getting Kerberos ticket offline login failed. Maybe I missed something and there is some better way as I am sure that my setup is similar to many other companies. Looking for any tips or recommendation on the integration of AD and IPA . Thanks.

1 0

Enable random certificate serial numbers on existing installation
by Kroon PC, Peter 23 Apr '25

23 Apr '25

Hello world, I recently set up the certificate ACME service on my IPA installation, and am looking into pruning old and expired certificates. However, when I try `ipa-acme-manage pruning --config-show` it tells me `Certificate pruning requires random serial numbers`. Is there any way to turn this on? I'm currently running ipa-server 4.12.2-1.el9_5.4. All I can find so far is that there is (currently?) no way to switch to the random serial numbers. Many thanks, Peter

2 2

Demo freeipa server authentication failure
by Joe Rafaniello 23 Apr '25

23 Apr '25

I'm getting "Login failed due to an unknown reason" using the credentials from the wiki: https://www.freeipa.org/page/Demo I'm trying to access: https://ipa.demo1.freeipa.org/ipa/ui/ It was working as of April 11th. Thanks!

3 2

ACI to allow a listing of cn=sysaccounts,cn=etc
by Rael S-R 23 Apr '25

23 Apr '25

# Context: ## Goal I eventually want to have a sysaccount with readonly access to a number of attributes in our FreeIPA deployment, which will be used by verification scripts in a scheduled pipeline that will prove certain accounts exist or do no exist. One of those checks is making sure that all the "sysaccounts" are expected (no extras), so I'll want a sysaccount that can list the other sysaccounts. ## Related posts and resources I've already seen some related posts, but I am still experiencing issues that I do not understand at this time: - "Allow sysaccount to view its own entry" : https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… - Probably the closest to my eventual goal, but I want a sysaccount that can get a list of other sysaccounts - FreeIPA Docs > LDAP > System Accounts : https://www.freeipa.org/page/HowTo/LDAP#system-accounts - I have created a number of accounts using the method listed here. These accounts are already in use and enable some of our internally deployed services to authenticate users via LDAP. - "Grant extra permissions to System Accounts" : https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… - mainly relevant because my underlying goal is to have a sysaccount that can read the attributes and sysaccount memberships cannot be managed through the web interface. - Documentation on ACIs: https://docs.redhat.com/en/documentation/red_hat_directory_server/12/html/m… - I only recently found out about ACIs and was previously only aware of the "Permissions/Privileges/Roles" aspect seen in the FreeIPA web UI. From testing, my understanding is that permissions are 1-to-1 with ACIs, though they get two entries: an LDAP entry under "cn=permissions,cn=pbac,..." and then a corresponding ACI attribute on the referenced LDAP entry. ## Technical - IPA version 4.12.2 - viewing of underlying LDAP is being done through a locally run instance of "phpLDAPadmin" - https://github.com/osixia/docker-phpLDAPadmin ## Personal I'm not an LDAP expert and have been trying to understand the various search and filter patterns from examples online, but it's quite likely I am messing up something in the syntax, or not correctly understanding the LDAP structure. Where possible I've tried to model my attempts on existing records or documentation (such as trying to match the created permission looks similar in LDAP to the `System: Read User Kerberos Login Attributes` permission) # Specific confusion I have been unable to get an ACI that allows a non-admin the ability to see the children of the "cn=sysaccounts,cn=etc,..." sub tree. My current test setup is: - My own admin user account (rael) - I am using this to read LDAP attributes and verify the data present, as well as edit permissions/privileges/roles in the web interface - A simple user account (rael_test) - Is a posix account - is a member of a fresh "FreeIPA State Verifier" role - "FreeIPA State Verifier" role has the privilege "testPriv", which has the permission "testPermission" (names adjusted to remove internal ticket information) - "testPermission" is configured to grant "read", "search" and "compare" rights - target subtree: `cn=sysaccounts,cn=etc,...` - extra target filter: `(objectclass=simplesecurityobject)` - I have also tried this with more permissive options, like `(objectclass=account)` or `(objectclass=*)` - effective attributes: `description`, `uid`, `dn` With this setup, the `rael_test` account is still unable to see any of the system accounts that have been created under "cn=sysaccounts,cn=etc,...". What is the reason for this? Why can't the `rael_test` account list the existing accounts that exist under the "cn=sysaccounts,cn=etc,..." tree? ## Details The relevant ACI on `cn=sysaccounts,cn=etc,dc=ghs,dc=nl`: ```ini aci: (targetattr = "description || dn || uid") (targetfilter = "(objectClass=simplesecurityobject)") (version 3.0;acl "permission:testPerm";allow (compare,read,search) groupdn = "ldap:///cn=testPerm,cn=permissions,cn=pbac,dc=ghs,dc=nl";) ``` Permission LDIFF: ```ini version: 1 # Entry 1: cn=testPerm,cn=permissions,cn=pbac,dc=ghs,d... dn: cn=testPerm,cn=permissions,cn=pbac,dc=ghs,dc=nl cn: testPerm ipapermbindruletype: permission ipapermincludedattr: uid ipapermincludedattr: description ipapermincludedattr: dn ipapermissiontype: SYSTEM ipapermissiontype: V2 ipapermlocation: cn=sysaccounts,cn=etc,dc=ghs,dc=nl ipapermright: read ipapermright: search ipapermright: compare ipapermtargetfilter: (objectclass=simplesecurityobject) member: cn=testPriv,cn=privileges,cn=pbac,dc=ghs,dc=nl objectclass: top objectclass: groupofnames objectclass: ipapermission objectclass: ipapermissionv2 ``` `rael_test` account permissions: ```ini version: 1 # Entry 1: uid=rael_test,cn=users,cn=accounts,dc=ghs,dc=nl dn: uid=rael_test,cn=users,cn=accounts,dc=ghs,dc=nl cn: rael user_level displayname: rael user_level gecos: rael user_level gidnumber: 62018 givenname: rael homedirectory: /home/rael_test loginshell: /bin/bash mail: rael_test(a)ghs.nl memberof: cn=ipausers,cn=groups,cn=accounts,dc=ghs,dc=nl memberof: cn=emea_users,cn=groups,cn=accounts,dc=ghs,dc=nl memberof: ipaUniqueID=da7a1b20-e360-11e8-8530-64006a50df1b,cn=hbac,... memberof: ipaUniqueID=ddb2cb20-e360-11e8-9400-64006a50df1b,cn=hbac,... memberof: ipaUniqueID=de9d0a8c-e360-11e8-9d46-64006a50df1b,cn=hbac,... memberof: ipaUniqueID=e03af1b0-e360-11e8-b7e1-64006a50df1b,cn=hbac,... memberof: ipaUniqueID=a1ac6390-ffb4-11e9-9e0a-1866da6daa3e,cn=hbac,... memberof: cn=workstation_users,cn=groups,cn=accounts,dc=ghs,dc=nl memberof: cn=FreeIPA State Verifier,cn=roles,cn=accounts,dc=ghs,dc=nl memberof: cn=testPriv,cn=privileges,cn=pbac,dc=ghs,dc=nl memberof: cn=testPerm,cn=permissions,cn=pbac,dc=ghs,dc=nl memberof: ipaUniqueID=a09b5cf0-b9db-11ee-8c88-509a4c9d3b10,cn=sudorules,cn=sudo,dc=ghs,dc=nl mepmanagedentry: cn=rael_test,cn=groups,cn=accounts,dc=ghs,dc=nl objectclass: top objectclass: person objectclass: organizationalperson objectclass: inetorgperson objectclass: inetuser objectclass: posixaccount objectclass: krbprincipalaux objectclass: krbticketpolicyaux objectclass: ipaobject objectclass: ipasshuser objectclass: ipaSshGroupOfPubKeys objectclass: mepOriginEntry objectclass: ipantuserattrs sn: user_level uid: rael_test uidnumber: 62018 ``` Please let me know if more information is needed.

2 2

Integrating DHCP with IPA
by William Muriithi 21 Apr '25

21 Apr '25

Hello I am aware that DHCP isn't currently supported but got felt like I had a chance after reading this thread. https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… I respect Alexander Bokovoy and his nudge was enough for me to try below project:- https://github.com/cabeljunky/freeipa-plugin-dhcp This is on fully update RHEL9 server with ipa-server-4.12.2-1.el9 and below command runs cleanly. ipa-server-install --setup-kra --setup-dns --setup-adtrust The plugin hasn't had any love for a long time, so was python2 based. I run 2to3 against the three python files and changed the location of python binary and it worked after that. When I run install.sh though, I get the error below. Everything before this point has run without an error. What would be the likely cause of this crash? Would the hostname sw-ipa-02.sw-lab.example.com cause this issue? Any pointer would be appreciated. Servers,cn=permissions,cn=pbac,dc=sw-lab,dc=example,dc=com";)'])] 2025-04-17T19:53:46Z DEBUG Updating managed permission: System: Modify DHCP Servers 2025-04-17T19:53:46Z DEBUG Updating ACI for managed permission: System: Modify DHCP Servers 2025-04-17T19:53:46Z DEBUG Adding ACI '(targetattr = "cn || dhcpcomments || dhcpoption || dhcpprimarydn || dhcpsecondarydn || dhcpservicedn || dhcpstatements || objectclass")(targetfilter = "(objectclass=dhcpserver)")(version 3.0;acl "permission:System: Modify DHCP Servers";allow (write) groupdn = "ldap:///cn=System: Modify DHCP Servers,cn=permissions,cn=pbac,dc=sw-lab,dc=example,dc=com";)' to cn=v4,cn=dhcp,dc=sw-lab,dc=example,dc=com 2025-04-17T19:53:46Z DEBUG update_entry modlist [(0, 'aci', [b'(targetattr = "cn || dhcpcomments || dhcpoption || dhcpprimarydn || dhcpsecondarydn || dhcpservicedn || dhcpstatements || objectclass")(targetfilter = "(objectclass=dhcpserver)")(version 3.0;acl "permission:System: Modify DHCP Servers";allow (write) groupdn = "ldap:///cn=System: Modify DHCP Servers,cn=permissions,cn=pbac,dc=sw-lab,dc=example,dc=com";)'])] 2025-04-17T19:53:46Z DEBUG Updating managed permission: System: Remove DHCP Servers 2025-04-17T19:53:46Z DEBUG Updating ACI for managed permission: System: Remove DHCP Servers 2025-04-17T19:53:46Z DEBUG Adding ACI '(targetfilter = "(objectclass=dhcpserver)")(version 3.0;acl "permission:System: Remove DHCP Servers";allow (delete) groupdn = "ldap:///cn=System: Remove DHCP Servers,cn=permissions,cn=pbac,dc=sw-lab,dc=example,dc=com";)' to cn=v4,cn=dhcp,dc=sw-lab,dc=example,dc=com 2025-04-17T19:53:46Z DEBUG update_entry modlist [(0, 'aci', [b'(targetfilter = "(objectclass=dhcpserver)")(version 3.0;acl "permission:System: Remove DHCP Servers";allow (delete) groupdn = "ldap:///cn=System: Remove DHCP Servers,cn=permissions,cn=pbac,dc=sw-lab,dc=example,dc=com";)'])] 2025-04-17T19:53:46Z DEBUG Updating managed permissions for dhcpservice 2025-04-17T19:53:46Z DEBUG Updating managed permission: System: Read DHCP Configuration 2025-04-17T19:53:46Z DEBUG Updating ACI for managed permission: System: Read DHCP Configuration 2025-04-17T19:53:46Z DEBUG Destroyed connection context.ldap2_140326465365328 2025-04-17T19:53:46Z DEBUG File "/usr/lib/python3.9/site-packages/ipapython/admintool.py", line 219, in execute return_value = self.run() File "/usr/lib/python3.9/site-packages/ipaserver/install/ipa_ldap_updater.py", line 150, in run modified = ld.update(self.files) or modified File "/usr/lib/python3.9/site-packages/ipaserver/install/ldapupdate.py", line 1041, in update self._run_updates(all_updates) File "/usr/lib/python3.9/site-packages/ipaserver/install/ldapupdate.py", line 992, in _run_updates self._run_update_plugin(update['plugin']) File "/usr/lib/python3.9/site-packages/ipaserver/install/ldapupdate.py", line 968, in _run_update_plugin restart_ds, updates = self.api.Updater[plugin_name]() File "/usr/lib/python3.9/site-packages/ipalib/frontend.py", line 1560, in __call__ return self.execute(**options) File "/usr/lib/python3.9/site-packages/ipaserver/install/plugins/update_managed_permissions.py", line 377, in execute self.update_permission(ldap, File "/usr/lib/python3.9/site-packages/ipaserver/install/plugins/update_managed_permissions.py", line 484, in update_permission permission_plugin.update_aci(entry) File "/usr/lib/python3.9/site-packages/ipaserver/plugins/permission.py", line 659, in update_aci return self._replace_aci(permission_entry, old_name, new_acistring) File "/usr/lib/python3.9/site-packages/ipaserver/plugins/permission.py", line 671, in _replace_aci acientry, acistring = self._get_aci_entry_and_string( File "/usr/lib/python3.9/site-packages/ipaserver/plugins/permission.py", line 731, in _get_aci_entry_and_string acientry = ldap.get_entry(location, ['aci']) File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1962, in get_entry return super(LDAPCache, self).get_entry( File "/usr/lib/python3.9/site-packages/ipapython/ipaldap.py", line 1660, in get_entry assert isinstance(dn, DN) 2025-04-17T19:53:46Z DEBUG The ipa-ldap-updater command failed, exception: AssertionError: 2025-04-17T19:53:46Z ERROR Unexpected error - see /var/log/ipaupgrade.log for details: AssertionError: 2025-04-17T19:53:46Z ERROR The ipa-ldap-updater command failed. See /var/log/ipaupgrade.log for more information Regards, William

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users April 2025