FreeIPA-users July 2025

freeipa-users@lists.fedorahosted.org

27 participants
35 discussions

command completion in 4.12.2 in container
by lejeczek 15 Jul '25

15 Jul '25

Hi guys. I have newly installed 4.12.2 in container where 'ipa ' does not complete - whereas older 4.10.1 also in container, does do it. Both have bash-completion - am I missing something? many thanks, L.

3 2

Re: pki-tomcat won't start after CA certs updated, getcert still shows a lot of expired certs
by Schrier, William (Contractor) 14 Jul '25

14 Jul '25

I think we are ready to cut our losses on this server. At this point, I am planning on simply building a new server (Oracle Linux 8 is the highest approved in our environment at this time) and installing a new FreeIPA server. Is there a way I could extract all the useful information I need out of my current FreeIPA server without taking any of the certs so I could import it into the new FreeIPA server to get it up to speed quickly to cutover? Will the ipa-backup/ipa-restore commands work for this? Will that even work when changing OS and version as part of the restore? Is this better handled as a new thread? Thanks for all the help with this! I truly appreciate it! Will

1 0

Unable to create freeipa instance
by CoreyLee Hassell 14 Jul '25

14 Jul '25

I am redoing freeipa infrastructure in my homelab because I need RSNv3s for ACME to work. However, on both Fedora 42 and Alma 10, I get the following error during CA setup. Command used: `ipa-server-install --setup-dns --no-forwarders --random-serial-numbers --ssh-trust-dns --mkhomedir` [20/33]: requesting RA certificate from CA [error] CalledProcessError: CalledProcessError(Command ['/usr/bin/openssl', 'pkcs12', '-nocerts', '-in', '/root/ca-agent.p12', '-out', '/var/lib/ipa/tmp_vwkehi7', '-passin', 'file:/tmp/tmp_kb5jcg3', '-nodes'] returned non-zero exit status 1: 'Error outputting keys and certificates\n80F281632D7F0000:error:1C800064:Provider routines:ossl_cipher_unpadblock:bad decrypt:providers/implementations/ciphers/ciphercommon_block.c:107:\n80F281632D7F0000:error:11800074:PKCS12 routines:PKCS12_pbe_crypt_ex:pkcs12 cipherfinal error:crypto/pkcs12/p12_decr.c:84:maybe wrong password\n') CalledProcessError(Command ['/usr/bin/openssl', 'pkcs12', '-nocerts', '-in', '/root/ca-agent.p12', '-out', '/var/lib/ipa/tmp_vwkehi7', '-passin', 'file:/tmp/tmp_kb5jcg3', '-nodes'] returned non-zero exit status 1: 'Error outputting keys and certificates\n80F281632D7F0000:error:1C800064:Provider routines:ossl_cipher_unpadblock:bad decrypt:providers/implementations/ciphers/ciphercommon_block.c:107:\n80F281632D7F0000:error:11800074:PKCS12 routines:PKCS12_pbe_crypt_ex:pkcs12 cipherfinal error:crypto/pkcs12/p12_decr.c:84:maybe wrong password\n') The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information Fedora 42 (freeipa-server package 4.12.2-14.fc42) On alma, OpenSSL is `OpenSSL 3.2.2 4 Jun 2024 (Library: OpenSSL 3.2.2 4 Jun 2024)` The freeipa-server package is ipa-server-4.12.2-15.el10.aarch64.rpm

3 4

Monitoring the ID ranges
by Aurelien Bompard 09 Jul '25

09 Jul '25

Hey folks! On Fedora we have reached the limit of our ID ranges again. I've added a fourth additional ID range, but I wonder if there would be a way for us to monitor ID range usage in Nagios / Zabbix, so that we anticipate it next time rather than having users failing to create a new account. I'd like to get the number of free IDs, is there something like this in IPA already? I see that there are some interesting functions in ipaserver/install/ipa_idrange_fix.py, should I try to write a script using them, or on the contrary avoid using them if they are private? Thanks! Aurélien

3 3

Windows 11 and GSSApiCredentialDelegation
by Ronald Wimmer 09 Jul '25

09 Jul '25

Several colleagues are reporting that CredentialDelegation in tools like PuTTY, MobaXTerm, XShell ar not working any more under Windows 11. Are you aware of any changes here? Does Windows 11 require special settings here? Cheers Ronald

1 0

One IPA instance for multiple domains
by Ronald Wimmer 09 Jul '25

09 Jul '25

Currently, we operate three separate IPA instances across different domains, each separated by firewalls. Since we require a unified user and group base across all of them, managing this setup has become quite cumbersome. Would it be feasible to consolidate everything into a single IPA instance serving all three domains? I'm aware of features like IPA locations and the ability to configure additional realms, but would those be sufficient? In my opinion, one possible approach might be to set up a central IPA environment with four servers, complemented by "satellite" replicas in each domain. These could be prioritized by clients within their respective networks using the locations feature. @ipa-devs – I’d appreciate your insights on this! Cheers, Ronald

2 2

Disable password expiration for certain users
by Ronald Wimmer 09 Jul '25

09 Jul '25

Is it a good way to go this route: https://access.redhat.com/solutions/885383 = creating a password policy with minlife=0 and maxlife=0 Or is there a better way to achieve this? Cheers, Ronald

2 2

migrate from self signed root CA to an external signed one
by Kathy Zhu 07 Jul '25

07 Jul '25

Hello team, From my reading, it is possible to migrate IPA from a self signed root CA to an external signed one, after the migration, I know: 1. all IPA clients should "ipa-certupdate" to get the new CA I do not know: 1. what will happen to the SSL certificates issued with the old self signed root CA? 2. what will happen to the subCA issued with the old self signed root CA? Could someone share the answers? Thanks. Kathy.

2 2

pki-tomcat won't start after CA certs updated, getcert still shows a lot of expired certs
by Schrier, William (Contractor) 07 Jul '25

07 Jul '25

Our FreeIPA CA cert (externally signed via a Microsoft AD CA) recently expired. Unfortunately, I didn't notice it until after it expired. After jumping through some hoops and some help from Florence's blog, I was able to get new certificates installed successfully (at least according to the ipa-cacert-manage and ipa-certupdate commands). However, at this point, pki-tomcat will not start and ipa-getcert and getcert don't really show what I would expect... Oh - also, I should point out that I'm running on Oracle Linux 7.9 and FreeIPA VERSION: 4.6.8, API_VERSION: 2.237 - yes, I know I'm far from the latest out there, but until I can upgrade this server to a new OS, I'm kind of stuck... and unfortunately, my situation here is making upgrading the OS difficult, so please forgive me that I'm asking for assistance on such an old setup, but know that the goal is to upgrade, but that's not possible at this exact moment, so if I can fix this current setup to see me through until I can upgrade, that would be really good. Any suggestions so we can get these certs installed properly and get pki-tomcat started would be appreciated! When I run ipa-getcert list, I get the following (which is still showing the old cert): # ipa-getcert list Number of certificates and requests being tracked: 7. Request ID '20210201172924': status: NEED_TO_SUBMIT ca-error: Server at https://[hostname]/ipa/xml failed request, will retry: 907 (RPC failed at server. cannot connect to 'https://[hostname]:443/ca/rest/account/login': [SSL: SSL_HANDSHAKE_FAILURE] ssl handshake failure (_ssl.c:1826)). stuck: no key pair storage: type=FILE,location='/var/kerberos/krb5kdc/kdc.key' certificate: type=FILE,location='/var/kerberos/krb5kdc/kdc.crt' CA: IPA issuer: CN=Certificate Authority,O=[DOMAIN] subject: CN=[hostname],O=[DOMAIN] expires: 2025-05-31 15:41:32 UTC principal name: krbtgt/[DOMAIN@DOMAIN]<mailto:krbtgt/PEACECORPS.GOV@PEACECORPS.GOV> key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-serverAuth,id-pkinit-KPKdc pre-save command: post-save command: /usr/libexec/ipa/certmonger/renew_kdc_cert track: yes auto-renew: yes And running getcert list returns mostly the old expired cert, but with one entry with the new cert: # getcert list | egrep "Request ID|status:|CA:|expires:" Request ID '20210201172746': status: CA_UNREACHABLE CA: dogtag-ipa-ca-renew-agent expires: 2025-05-31 15:41:32 UTC Request ID '20210201172819': status: MONITORING CA: dogtag-ipa-ca-renew-agent expires: 2025-05-31 15:41:32 UTC Request ID '20210201172820': status: MONITORING CA: dogtag-ipa-ca-renew-agent expires: 2025-05-31 15:41:32 UTC Request ID '20210201172821': status: MONITORING CA: dogtag-ipa-ca-renew-agent expires: 2025-05-31 15:41:32 UTC Request ID '20210201172822': status: MONITORING CA: dogtag-ipa-ca-renew-agent expires: 2027-06-09 13:26:26 UTC Request ID '20210201172823': status: MONITORING CA: dogtag-ipa-ca-renew-agent expires: 2025-05-31 15:41:32 UTC Request ID '20210201172924': status: CA_UNREACHABLE CA: IPA expires: 2025-05-31 15:41:32 UTC I do see the following in /var/log/pki/pki-tomcat/ca/debug: Could not connect to LDAP server host [hostname] port 636 Error netscape.ldap.LDAPException: Authentication failed (48) Internal Database Error encountered: Could not connect to LDAP server host [hostname] port 636 Error netscape.ldap.LDAPException: Authentication failed (48) And /var/log/pki/pki-tomcat/localhost.[date].log gets tons of these: SEVERE: Exception Processing /ca/admin/ca/getStatus javax.ws.rs.ServiceUnavailableException: Subsystem unavailable at com.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints(ProxyRealm.java:145) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:492) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445) at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1091) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637) at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:750) SEVERE: Exception Processing /ca/ee/ca/profileSubmit javax.ws.rs.ServiceUnavailableException: Subsystem unavailable at com.netscape.cms.tomcat.ProxyRealm.findSecurityConstraints(ProxyRealm.java:145) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:492) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103) at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:962) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445) at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1091) at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637) at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:750)

3 14

strategy on containerized freeipa upgrades ?
by lejeczek 07 Jul '25

07 Jul '25

Hi guys. Most likely the fact the IPA deployment is containerized probably does not matter - thought I should mention it - nor makes difference VS "real" host. How do you do your upgrades these days - I have not done one recently - I'm looking to go from 4.10.1 to 4.12.2. Do you go about it by adding new-version masters, then removing old ones - I thought this perhaps is bit more work but no downtime + more redundancy in case of something going hay wire - or you just upgrade in-place? many thanks, L.

2 3

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2025