FreeIPA-users July 2025

freeipa-users@lists.fedorahosted.org

27 participants
35 discussions

Doubt about FreeIPA LDAP authentication
by John Tor 04 Jul '25

04 Jul '25

Hi everyone, I’ve read some documentation, but I’m not sure if FreeIPA supports authentication via the LDAP protocol. I saw that it now uses Kerberos for authentication, but I want to be sure. Can I configure an application to authenticate users using FreeIPA with LDAP parameters? I tried doing this, but I always get the same error: the user cannot log in via LDAP. In my setup, I used CN=Directory Manager for the bind configuration. Is this the right approach? Regards

3 4

Certificate CRL Distribution Points and RFC5280
by Frank Bergmann 03 Jul '25

03 Jul '25

Hi, on all FreeIPA instances I have the case that the webserver certificate has the same Issuer and CRLissuer. While it looks reasonable for FreeIPA to have the same here, it looks like it doesn't match RFC5280. RFC5280 says: "... either distributionPoint or cRLIssuer MUST be present. If the certificate issuer is not the CRL issuer, then the cRLIssuer field MUST be present and contain the Name of the CRL issuer. If the certificate issuer is also the CRL issuer, then conforming CAs MUST omit the cRLIssuer field and MUST include the distributionPoint field." If I understand this correctly then the CRLissuer MUST NOT be given in the certificate. But it is always set. Am I wrong? kind regards, Frank

1 0

I can't promote to "replica server"
by Daniel Ruiz 02 Jul '25

02 Jul '25

Hello, I want to configure a "replica server". I need that because in my scenario, main FreeIPA server is for some clients that are on the same net but I have an small HPC cluster where server is on the same public net but all compute nodes are running with private IP, so that clients connect to the HPC server to get users and $HOMEs. My idea is configure HPC server as "replica" to get all users from the main server and, then, all HPC clients could connect with the same users. I have done these steps: 1. Install FreeIPA server on main server (OK!) 2. Configure all public clients as FreeIPA clients from server in point 1. (OK!) 3. Configure HPC server as client from domain that main servers is serving in point 1 (OK!) 4. Promote HPC server as FreeIPA replica server --> NO, ERROR! After running "ipa-replica-install", error is: "Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up". Cannot promote this client to a replica. Local domain 'MYDOMAIN' does not match IPA domain "machine.domain". The ipa-replica-innstall command failed." Yes, "MYDOMAIN" is the FreeIPA domain (get from my old YPSERV system). That domain is different from the machine domain name because I domain name is for whole organitzation and I think is better not to take that, so I have configured a different FreeIPA domain name. During configuration as FreeIPA server, system didn't return any problem about machine domain name and FreeIPA domain name. I assigned "realm name" as MYDOMAIN and all process ended correctly. However, HPC server can't promote to replica. What am I doing wrong? Thanks.

2 1

ipalockout_postop - User fqdn=... is locked out. Too many failed authentication attempts.
by Anthony Messina 01 Jul '25

01 Jul '25

With FreeIPA 4.12.2-14.fc42 (and likely before), I have two hosts created in February 2025 that trigger the following: ns-slapd: ALERT - ipalockout_postop - User fqdn=ws1.example.com,cn=computers,cn=accounts,dc=example,dc=com is locked out. Too many failed authentication attempts. They were enrolled using OTP just like my other hosts in the past have been. They are the only two hosts in my dual-master FreeIPA setup with multiple hosts that show krbLastFailedAuth and krbLoginFailedCount: ~]# ipa host-show ws1 --all --raw ... has_password: FALSE has_keytab: TRUE krbLastFailedAuth: 20250217182326Z krbLastPwdChange: 20250216234605Z krbLoginFailedCount: 0 How do they get this way and is there a way to "unlock" these hosts? Thanks. -- Anthony - https://messinet.com

2 2

Fedora 41 - ssl/tls alert handshake failure on CA subsystem
by Hannes Eberhardt 01 Jul '25

01 Jul '25

Hi, I recently upgraded my FreeIPA host system from Fedorda 40 to 41. Since the upgrade I am unable to access the details of the CA subsystem. While I get a list/overview of all certificates that are available in the directory, FreeIPA throws an error if I try to access a specific certificate or CA. The error is: IPA Error 907: Network Error cannot connect to 'https://my-idm-server.idm.my.domain:443/ca/rest/certs/216402019788816070027…' : [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:2638) I am also getting this error while running the ipa-healthcheck. { "source": "ipahealthcheck.dogtag.ca", "check": "DogtagCertsConnectivityCheck", "result": "ERROR", "uuid": "84949312-c4a1-4924-95e5-338894d2ee27", "when": "20250122094218Z", "duration": "0.022545", "kw": { "key": "cert_show_ra", "error": "cannot connect to 'https://my-idm-server.idm.my.domain:443/ca/rest/certs/198421384424903357883…' : [SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] ssl/tls alert handshake failure (_ssl.c:2638)", "serial": "198421384424903357883919048254057663382", "msg": "Request for certificate failed: {error}" } }, [...] I am able to get a working TLS Handshake and a sensible reply with curl on the same machine. At first I guessd it might be an incompatiblity with TLSv1.3, so I tried to configure only TLSv1.2 in the httpd ssl.conf, but this did not resolve the issue. I also tried to use the legacy system crypto-policy instead of the default one. So I don't really think that this is a cipher missmatch/compatiblity issue. Could this be a verification issue on the certificate chain somewhere? Does someone maybe have a hint where to start looking next and get this fixed? FreeIPA Version 4.12.2 OS: Fedora 41 Server, no upgrades pending, default repos. Thank you for your help! Cheers, Hannes

3 10

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2025