FreeIPA-users July 2025

freeipa-users@lists.fedorahosted.org

27 participants
35 discussions

Strange behaviour with CA
by LHEUREUX Bernard 28 Jul '25

28 Jul '25

Hi all, I remarked a strage thing in our FreeIPA infrastructure containing 3 servers/replicas... When I type "pki securitydomain-show" The KRA part shows correctly the 3 servers, but the CA part shows only 2 of the 3 servers but when I check CA is installed on the 3 servers... [root@ipa01 ~]# pki securitydomain-show Domain: IPA CA Subsystem: Host ID: CA ipa03.mydomain.infra 443 Hostname: ipa03.mydomain.infra Port: 80 Secure Port: 443 Domain Manager: TRUE Host ID: CA ipa01.mydomain.infra 443 Hostname: ipa01.mydomain.infra Port: 80 Secure Port: 443 Domain Manager: TRUE KRA Subsystem: Host ID: KRA ipa03.mydomain.infra 443 Hostname: ipa03.mydomain.infra Port: 80 Secure Port: 443 Domain Manager: FALSE Host ID: KRA ipa02.mydomain.infra 443 Hostname: ipa02.mydomain.infra Port: 80 Secure Port: 443 Domain Manager: FALSE Host ID: KRA ipa01.mydomain.infra 443 Hostname: ipa01.mydomain.infra Port: 80 Secure Port: 443 Domain Manager: FALSE [root@ipa01 ~]# ipa server-role-show ipa02.mydomain.infra "ca server" Server name: ipa02.mydomain.infra Role name: CA server Role status: enabled How could I correct that ? Thanks for your advices... [https://www.win.be/images/fr/logowin.jpg] Bernard LHEUREUX OS, DB & Platform Cloud Engineer win.be <https://www.win.be> [facebook]<http://www.youtube.com/channel/UC-rXMcRf_tMl5K4EBHKWpGg> [linkedin] <https://www.linkedin.com/company/win-s-a-/> [twitter] <https://x.com/win_ICTpartner> ________________________________ 1/Conform?ment ? notre certification ISO 27001, ce message et toute pi?ce jointe sont la propri?t? exclusive de Win. L'information contenue dans cet e- mail peut s'av?rer confidentielle et d?s lors prot?g?e de toute divulgation. Si vous avez re?u cette communication par erreur, veuillez nous en informer imm?diatement en r?pondant ? ce message et en le supprimant de votre ordinateur, sans le copier ni le divulguer. 2/L'acceptation de toute offre commerciale (quel qu'en soit le support) emporte l'adh?sion aux descriptifs (notamment techniques) inh?rents aux solutions offertes, ainsi qu'aux conditions commerciales g?n?rales de Win, consultables via https://www.win.be/cgv DISCLAIMER : https://www.win.be/fr-win/disclaimer.htm

2 2

Issue with ipa-replica-install Failing at pki-tomcatd
by Pierre Labanowski 24 Jul '25

24 Jul '25

Hello everyone, I'm currently managing several FreeIPA servers running on RHEL 8 (version 4.9.12-7.module_el8). I'm attempting to set up a replica on a new RHEL 9 server (version 4.12.2-14.el9_6.1) following the official documentation. However, during the execution of ipa-replica-install, the process halts at the "Configuring certificate server (pki-tomcatd)" step with the following error: [33/33]: deploying ACME service Done configuring certificate server (pki-tomcatd). Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up.:contentReference[oaicite:25]{index=25} CalledProcessError(Command ['/bin/systemctl', 'start', 'pki-tomcatd(a)pki-tomcat.service'] returned non-zero exit status 1: 'Job for pki-tomcatd(a)pki-tomcat.service failed because the control process exited with error code.\n See "systemctl status pki-tomcatd(a)pki-tomcat.service" and "journalctl -xeu pki-tomcatd(a)pki-tomcat.service" for details.\n') Upon investigation, I discovered that the pki-tomcatd service fails to start due to low default limits in the dse.ldif configuration. By increasing the lock and time limits and restarting the dirsrv service, I was able to start pki-tomcatd successfully. My challenge now is completing the replica installation without performing a full uninstall using ipa-server-install --uninstall, as this would erase my configuration changes, causing the same issue to recur. Is there a method to resume or complete the installation process from its current state without starting over? Any guidance or suggestions would be greatly appreciated. Thank you for your assistance. Best regards, -- *Pierre Labanowski*

3 7

User not able to login in FreeIPA v4.12.2, working in v4.9.13
by Tinku Goyal 24 Jul '25

24 Jul '25

My cluster is having 3 IPA Replica servers. 2 are on version 4.12.2 recently added replicas and 1 is on 4.9.13 version running from a long time. I tried to reset password for a user today through new replica and password reset is done, however when that user is trying to login to the portal to change its password at first login post reset password, he is not able to login on the portal 4.12.2 while he can login to portal on 4.9.13. Also, my cluster is having some ghost replicas which I tried to remove but it is not allowing me to remove them. These are just showing in topologies and list of IPA servers but in real these servers are decommissioned. Please let me know if any more details are required. Thanks

1 0

FreeIPA and temp nodes
by alexey safonov 23 Jul '25

23 Jul '25

Hi, we have slurm cluster that is spinning up virtual machines and destroying them after load, so the controller is IPA enrolled, but is there are any way to auto enroll virtual machine to IPA so we have same UIDs/GIDs across the cluster? Alex

3 4

Redmine ?
by lejeczek 18 Jul '25

18 Jul '25

Hi guys. I used this - https://www.freeipa.org/page/HowTo/Authenticating_Redmine_with_IPA to setup Redmine - in container - with LDAP, which conn-tests ok, but ldap users fail to login. I also conn-test outside of Redmine - all seems okey. ... conn=226 op=0 BIND dn="uid=redmine,cn=sysaccounts,cn=etc,dc=mine,dc=priv" method=128 version=3 conn=226 op=0 RESULT err=53 tag=97 nentries=0 wtime=0.000134983 optime=0.000054222 etime=0.000188403 ... Which I think means misconfigured bind ? I fiddled with Base DN but to no avail. Anybody runs Redmine - successfully? thanks, L.

2 2

Problem mounting kerberised nfs over a second network
by wodel youchi 18 Jul '25

18 Jul '25

Hi, I have a freeipa server on the mgmt network, and an nfs-server and an nfs-client that have two network ports, one on the mgmt network, the second on the storage network. I did configure NFS with kerberos with automount (to mount users home directories) and it did work using the mgmt network, but when I changed my export to use the storage network it won't work anymore. I get "permission denied" when I login. How can I make this work? Regards.

2 1

Proper method for updating client /var/lib/ipa-client/pki/ bundles
by Ty zang 17 Jul '25

17 Jul '25

Hey all, I am troubleshooting an authentication issue with my clients that happened after a mass PKI cert expiration on my third party CA (root, issuer, and a ton of others). When I authenticate on a client to IPA, it sends my request to the RADIUS server (RSA Auth Mgr) and prompts for first token and second token. Once I enter those, it lets me in (SSH). But for xRDP, it keeps failing and the only log I have on RSA is "bad tokencode but good PIN". I do see an error code 7 in one of the logs (was it secure log?). So that is how I got to where I am. I looked at /etc/krb5.conf and it points to two files: /var/lib/ipa-client/pki/ca-bundle /var/lib/ipa-client/pki/kdc-ca-bundle When I look at the certs in these files, I do see the expired root and issuer (and a valid IPA certificate authority cert). What is the proper way to update these two third party certs in these files on the ipa clients? Should I use keytool/openssl to rip the old ones out and import the new PEM files? I believe I already dropped these two certs under /etc/pki/ca-trust/source/anchors/ and ran "update-ca-trust" but these files seem remain invalid. Just looking for the proper way, so appreciate the help!

3 2

No valid Negotiate header in server response, keytabs regenerated
by Felix O 16 Jul '25

16 Jul '25

Hi, when trying to run any ipa cli commands, they fail with the message ipa: ERROR: No valid Negotiate header in server response. Trying to sign into the web ui fails by unknown error. The instance has had its certificates expired and then renewed using ipa-cert-fix, after which the problem occurred. I have regenerated the host keytab and gssproxy keytab using the following commands, to no success. (the command succeeds, but it doesn't help the issue) ipa-getkeytab -s ipa.example.com -p host/ipa.example.com(a)EXAMPLE.COM -k /etc/krb5.keytab ipa-getkeytab -s ipa.example.com -p HTTP/ipa.example.com(a)EXAMPLE.COM -k /var/lib/ipa/gssproxy/http.keytab Felix

5 9

Users without an ipaNTSecurityIdentifier cannot authenticate on the new replica server
by Tien Cao Huy 16 Jul '25

16 Jul '25

Dear, I’ve added a new replica server. The replication completed successfully, but users without an ipaNTSecurityIdentifier are unable to log in to the WebUI on the new replica server. The other (older) replica servers are still working fine. Only users with an ipaNTSecurityIdentifier can authenticate successfully. How can I resolve this issue? Should I run the command ipa config-mod --enable-sid --add-sids on this replica server? I need to know if I follow this command it will affect the active server working now? Best regards,

4 12

Cannot join realm domain from Initial Setup (Enterprise login)
by William Oprandi 16 Jul '25

16 Jul '25

I try to be able to join my realm from Initial Setup without success. I always get the error message "Couldn't log in as user: Couldn't connect to the xxx domain: Cannot contact any KDC for realm 'XXX'" But if I use `realm discover` and `realm join` commands, it installs necessary packages and the host is correctly enrolled into FreeIPA Also fail from settings > users > Add Enterprise Login, "Failed to log into domain" (despite "Valid domain") I don't see errors from realmd service I don't know what to check

3 8

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2025