July 2025 - FreeIPA-users - Fedora mailing-lists

Users without an ipaNTSecurityIdentifier cannot authenticate on the new replica server
by Tien Cao Huy 14 Jul '25

14 Jul '25

Dear, I’ve added a new replica server. The replication completed successfully, but users without an ipaNTSecurityIdentifier are unable to log in to the WebUI on the new replica server. The other (older) replica servers are still working fine. Only users with an ipaNTSecurityIdentifier can authenticate successfully. How can I resolve this issue? Should I run the command ipa config-mod --enable-sid --add-sids on this replica server? I need to know if I follow this command it will affect the active server working now? Best regards,

1 0

Unable to create freeipa instance
by CoreyLee Hassell 12 Jul '25

12 Jul '25

I am redoing freeipa infrastructure in my homelab because I need RSNv3s for ACME to work. However, on both Fedora 42 and Alma 10, I get the following error during CA setup. Command used: `ipa-server-install --setup-dns --no-forwarders --random-serial-numbers --ssh-trust-dns --mkhomedir` [20/33]: requesting RA certificate from CA [error] CalledProcessError: CalledProcessError(Command ['/usr/bin/openssl', 'pkcs12', '-nocerts', '-in', '/root/ca-agent.p12', '-out', '/var/lib/ipa/tmp_vwkehi7', '-passin', 'file:/tmp/tmp_kb5jcg3', '-nodes'] returned non-zero exit status 1: 'Error outputting keys and certificates\n80F281632D7F0000:error:1C800064:Provider routines:ossl_cipher_unpadblock:bad decrypt:providers/implementations/ciphers/ciphercommon_block.c:107:\n80F281632D7F0000:error:11800074:PKCS12 routines:PKCS12_pbe_crypt_ex:pkcs12 cipherfinal error:crypto/pkcs12/p12_decr.c:84:maybe wrong password\n') CalledProcessError(Command ['/usr/bin/openssl', 'pkcs12', '-nocerts', '-in', '/root/ca-agent.p12', '-out', '/var/lib/ipa/tmp_vwkehi7', '-passin', 'file:/tmp/tmp_kb5jcg3', '-nodes'] returned non-zero exit status 1: 'Error outputting keys and certificates\n80F281632D7F0000:error:1C800064:Provider routines:ossl_cipher_unpadblock:bad decrypt:providers/implementations/ciphers/ciphercommon_block.c:107:\n80F281632D7F0000:error:11800074:PKCS12 routines:PKCS12_pbe_crypt_ex:pkcs12 cipherfinal error:crypto/pkcs12/p12_decr.c:84:maybe wrong password\n') The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information Fedora 42 (freeipa-server package 4.12.2-14.fc42) On alma, OpenSSL is `OpenSSL 3.2.2 4 Jun 2024 (Library: OpenSSL 3.2.2 4 Jun 2024)` The freeipa-server package is ipa-server-4.12.2-15.el10.aarch64.rpm

1 1

Redmine ?
by lejeczek 11 Jul '25

11 Jul '25

Hi guys. I used this - https://www.freeipa.org/page/HowTo/Authenticating_Redmine_with_IPA to setup Redmine - in container - with LDAP, which conn-tests ok, but ldap users fail to login. I also conn-test outside of Redmine - all seems okey. ... conn=226 op=0 BIND dn="uid=redmine,cn=sysaccounts,cn=etc,dc=mine,dc=priv" method=128 version=3 conn=226 op=0 RESULT err=53 tag=97 nentries=0 wtime=0.000134983 optime=0.000054222 etime=0.000188403 ... Which I think means misconfigured bind ? I fiddled with Base DN but to no avail. Anybody runs Redmine - successfully? thanks, L.

2 1

Cannot join realm domain from Initial Setup (Enterprise login)
by William Oprandi 11 Jul '25

11 Jul '25

I try to be able to join my realm from Initial Setup without success. I always get the error message "Couldn't log in as user: Couldn't connect to the xxx domain: Cannot contact any KDC for realm 'XXX'" But if I use `realm discover` and `realm join` commands, it installs necessary packages and the host is correctly enrolled into FreeIPA Also fail from settings > users > Add Enterprise Login, "Failed to log into domain" (despite "Valid domain") I don't see errors from realmd service I don't know what to check

2 1

Monitoring the ID ranges
by Aurelien Bompard 09 Jul '25

09 Jul '25

Hey folks! On Fedora we have reached the limit of our ID ranges again. I've added a fourth additional ID range, but I wonder if there would be a way for us to monitor ID range usage in Nagios / Zabbix, so that we anticipate it next time rather than having users failing to create a new account. I'd like to get the number of free IDs, is there something like this in IPA already? I see that there are some interesting functions in ipaserver/install/ipa_idrange_fix.py, should I try to write a script using them, or on the contrary avoid using them if they are private? Thanks! Aurélien

3 3

Windows 11 and GSSApiCredentialDelegation
by Ronald Wimmer 09 Jul '25

09 Jul '25

Several colleagues are reporting that CredentialDelegation in tools like PuTTY, MobaXTerm, XShell ar not working any more under Windows 11. Are you aware of any changes here? Does Windows 11 require special settings here? Cheers Ronald

1 0

One IPA instance for multiple domains
by Ronald Wimmer 09 Jul '25

09 Jul '25

Currently, we operate three separate IPA instances across different domains, each separated by firewalls. Since we require a unified user and group base across all of them, managing this setup has become quite cumbersome. Would it be feasible to consolidate everything into a single IPA instance serving all three domains? I'm aware of features like IPA locations and the ability to configure additional realms, but would those be sufficient? In my opinion, one possible approach might be to set up a central IPA environment with four servers, complemented by "satellite" replicas in each domain. These could be prioritized by clients within their respective networks using the locations feature. @ipa-devs – I’d appreciate your insights on this! Cheers, Ronald

2 2

Disable password expiration for certain users
by Ronald Wimmer 09 Jul '25

09 Jul '25

Is it a good way to go this route: https://access.redhat.com/solutions/885383 = creating a password policy with minlife=0 and maxlife=0 Or is there a better way to achieve this? Cheers, Ronald

2 2

Strange behaviour with CA
by LHEUREUX Bernard 08 Jul '25

08 Jul '25

Hi all, I remarked a strage thing in our FreeIPA infrastructure containing 3 servers/replicas... When I type "pki securitydomain-show" The KRA part shows correctly the 3 servers, but the CA part shows only 2 of the 3 servers but when I check CA is installed on the 3 servers... [root@ipa01 ~]# pki securitydomain-show Domain: IPA CA Subsystem: Host ID: CA ipa03.mydomain.infra 443 Hostname: ipa03.mydomain.infra Port: 80 Secure Port: 443 Domain Manager: TRUE Host ID: CA ipa01.mydomain.infra 443 Hostname: ipa01.mydomain.infra Port: 80 Secure Port: 443 Domain Manager: TRUE KRA Subsystem: Host ID: KRA ipa03.mydomain.infra 443 Hostname: ipa03.mydomain.infra Port: 80 Secure Port: 443 Domain Manager: FALSE Host ID: KRA ipa02.mydomain.infra 443 Hostname: ipa02.mydomain.infra Port: 80 Secure Port: 443 Domain Manager: FALSE Host ID: KRA ipa01.mydomain.infra 443 Hostname: ipa01.mydomain.infra Port: 80 Secure Port: 443 Domain Manager: FALSE [root@ipa01 ~]# ipa server-role-show ipa02.mydomain.infra "ca server" Server name: ipa02.mydomain.infra Role name: CA server Role status: enabled How could I correct that ? Thanks for your advices... [https://www.win.be/images/fr/logowin.jpg] Bernard LHEUREUX OS, DB & Platform Cloud Engineer win.be <https://www.win.be> [facebook]<http://www.youtube.com/channel/UC-rXMcRf_tMl5K4EBHKWpGg> [linkedin] <https://www.linkedin.com/company/win-s-a-/> [twitter] <https://x.com/win_ICTpartner> ________________________________ 1/Conform?ment ? notre certification ISO 27001, ce message et toute pi?ce jointe sont la propri?t? exclusive de Win. L'information contenue dans cet e- mail peut s'av?rer confidentielle et d?s lors prot?g?e de toute divulgation. Si vous avez re?u cette communication par erreur, veuillez nous en informer imm?diatement en r?pondant ? ce message et en le supprimant de votre ordinateur, sans le copier ni le divulguer. 2/L'acceptation de toute offre commerciale (quel qu'en soit le support) emporte l'adh?sion aux descriptifs (notamment techniques) inh?rents aux solutions offertes, ainsi qu'aux conditions commerciales g?n?rales de Win, consultables via https://www.win.be/cgv DISCLAIMER : https://www.win.be/fr-win/disclaimer.htm

2 1

migrate from self signed root CA to an external signed one
by Kathy Zhu 07 Jul '25

07 Jul '25

Hello team, From my reading, it is possible to migrate IPA from a self signed root CA to an external signed one, after the migration, I know: 1. all IPA clients should "ipa-certupdate" to get the new CA I do not know: 1. what will happen to the SSL certificates issued with the old self signed root CA? 2. what will happen to the subCA issued with the old self signed root CA? Could someone share the answers? Thanks. Kathy.

2 2

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2025