FreeIPA-users May 2026

freeipa-users@lists.fedorahosted.org

16 participants
11 discussions

ipa-replica-install failing at initial replication
by Tania Hagan 19 May '26

19 May '26

Hi FreeIPA users, I'm attempting to install a replica on Rocky 10 from an existing replica on Rocky 9. On the replica I see: sudo grep -iE "critical|error|exception" /var/log/ipareplica-install.log 2026-05-14T15:36:52Z DEBUG Entry found [LDAPEntry(ipapython.dn.DN('cn=meToipa-lon-3.thomac.net,cn=replica,cn=dc\=thomac\,dc\=net,cn=mapping tree,cn=config'), {'objectClass': [b'nsds5replicationagreement', b'top'], 'cn': [b'meToipa-lon-3.thomac.net'], 'nsDS5ReplicaHost': [b'ipa-lon-3.thomac.net'], 'nsDS5ReplicaPort': [b'389'], 'nsds5replicaTimeout': [b'120'], 'nsDS5ReplicaRoot': [b'dc=thomac,dc=net'], 'description': [b'me to ipa-lon-3.thomac.net'], 'nsDS5ReplicatedAttributeList': [b'(objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime'], 'nsDS5ReplicaTransportInfo': [b'LDAP'], 'nsDS5ReplicaBindMethod': [b'SASL/GSSAPI'], 'nsds5ReplicaStripAttrs': [b'modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp'], 'nsDS5ReplicatedAttributeListTotal': [b'(objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime'], 'nsds5replicareapactive': [b'0'], 'nsds5replicaLastUpdateStart': [b'19700101000000Z'], 'nsds5replicaLastUpdateEnd': [b'19700101000000Z'], 'nsds5replicaChangesSentSinceStartup': [b''], 'nsds5replicaLastUpdateStatus': [b'Error (49) Problem connecting to replica - LDAP error: Invalid credentials (connection error)'], 'nsds5replicaLastUpdateStatusJSON': [b'{"state": "red", "ldap_rc": "49", "ldap_rc_text": "Invalid credentials", "repl_rc": "16", "repl_rc_text": "connection error", "date": "2026-05-14T15:36:52Z", "message": "Error (49) Problem connecting to replica - LDAP error: Invalid credentials (connection error)"}'], 'nsds5replicaUpdateInProgress': [b'FALSE'], 'nsds5replicaLastInitStart': [b'19700101000000Z'], 'nsds5replicaLastInitEnd': [b'19700101000000Z']})] 2026-05-14T15:36:52Z DEBUG Entry found [LDAPEntry(ipapython.dn.DN('cn=meToipa-lon-1.thomac.net,cn=replica,cn=dc\=thomac\,dc\=net,cn=mapping tree,cn=config'), {'objectClass': [b'nsds5replicationagreement', b'top'], 'cn': [b'meToipa-lon-1.thomac.net'], 'nsDS5ReplicaHost': [b'ipa-lon-1.thomac.net'], 'nsDS5ReplicaPort': [b'389'], 'nsds5replicaTimeout': [b'120'], 'nsDS5ReplicaRoot': [b'dc=thomac,dc=net'], 'description': [b'me to ipa-lon-1.thomac.net'], 'nsDS5ReplicatedAttributeList': [b'(objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime'], 'nsDS5ReplicaTransportInfo': [b'LDAP'], 'nsDS5ReplicaBindMethod': [b'SASL/GSSAPI'], 'nsds5ReplicaStripAttrs': [b'modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp'], 'nsDS5ReplicatedAttributeListTotal': [b'(objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime'], 'nsds5replicareapactive': [b'0'], 'nsds5replicaLastUpdateStart': [b'19700101000000Z'], 'nsds5replicaLastUpdateEnd': [b'19700101000000Z'], 'nsds5replicaChangesSentSinceStartup': [b''], 'nsds5replicaLastUpdateStatus': [b'Error (0) No replication sessions started since server startup'], 'nsds5replicaLastUpdateStatusJSON': [b'{"state": "green", "ldap_rc": "0", "ldap_rc_text": "success", "repl_rc": "0", "repl_rc_text": "replica acquired", "date": "2026-05-14T15:36:52Z", "message": "Error (0) No replication sessions started since server startup"}'], 'nsds5replicaUpdateInProgress': [b'FALSE'], 'nsds5replicaLastInitStart': [b'19700101000000Z'], 'nsds5replicaLastInitEnd': [b'19700101000000Z']})] raise RuntimeError("Failed to start replication") RuntimeError: Failed to start replication 2026-05-14T15:38:58Z DEBUG [error] RuntimeError: Failed to start replication File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458, in _handle_exception File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 526, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458, in _handle_exception File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 523, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458, in _handle_exception raise RuntimeError("Failed to start replication") 2026-05-14T15:38:58Z DEBUG The ipa-replica-install command failed, exception: RuntimeError: Failed to start replication 2026-05-14T15:38:58Z ERROR Failed to start replication 2026-05-14T15:38:58Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information and on the existing replica I see: [14/May/2026:15:37:10.784513370 +0000] - WARN - content-sync-plugin - sync_update_persist_betxn_pre_op - DB retried operation targets "changenumber=68535600,cn=changelog" (op=0x7f62b0043800 idx_pl=1) => op not changed in PL [14/May/2026:15:38:50.526377911 +0000] - WARN - content-sync-plugin - sync_update_persist_betxn_pre_op - DB retried operation targets "changenumber=68535707,cn=changelog" (op=0x7f638133b800 idx_pl=1) => op not changed in PL [14/May/2026:15:38:50.590699199 +0000] - WARN - NSMMReplicationPlugin - replica_generate_next_csn - opcsn=6a05ee16000500340000 <= basecsn=6a05ee17000600300000, adjusted opcsn=6a05ee17000700340000 [14/May/2026:15:38:57.511706451 +0000] - ERR - NSMMReplicationPlugin - perform_operation - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): Failed to send extended operation: LDAP error -1 (Can't contact LDAP server) [14/May/2026:15:38:57.517218118 +0000] - ERR - NSMMReplicationPlugin - repl5_tot_log_operation_failure - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): Received error -1 (Can't contact LDAP server): for total update operation [14/May/2026:15:38:57.520123870 +0000] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): Unable to send endReplication extended operation (Can't contact LDAP server) [14/May/2026:15:38:57.522323162 +0000] - ERR - NSMMReplicationPlugin - repl5_tot_run - Total update failed for replica "agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389)", error (-11) [14/May/2026:15:38:57.524104058 +0000] - ERR - NSMMReplicationPlugin - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): Total update flow control triggered 59 times You may increase nsds5ReplicaFlowControlPause and/or decrease nsds5ReplicaFlowControlWindow in the replica agreement configuration [14/May/2026:15:38:57.816155969 +0000] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): Replication bind with GSSAPI auth resumed [14/May/2026:15:38:58.098378634 +0000] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. [14/May/2026:15:39:00.874788979 +0000] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. I remove the replica by running: On the existing replica: ipa-replica-manage del ipa-lon-3.thomac.net --force --cleanup ipa server-del ipa-lon-3.thomac.net ipa host-del ipa-lon-3.thomac.net dsconf -D "cn=Directory Manager" ldaps://localhost repl-agmt delete --suffix "dc=thomac,dc=net" meToipa-lon-3.thomac.net and find no replica agreements with ipa topologysegment-find ca, and ipa topologysegment-find domain On the new replica: ipa-server-install --uninstall -U and kdestroy -A When I attempt a reinstall I run: ipa-client-install --server ipa-lon-1.thomac.net --domain=thomac.net Make sure to add A record with PTR kinit admin ipa hostgroup-add-member ipaservers --hosts ipa-lon-3.thomac.net ipa-replica-install --principal admin -v and it still fails. The vms are on the same network, subnet, and have the same mtu ipa-healthcheck returns [] the clock is the same dig and host is good from both machines I've also tried the command to a different replica and it still fails I was able to upgrade my poc freeipa from rocky 9 and rocky 10 fine using both manual commands and ansible playbook, but my production freeipa replicas are failing. Any ideas of anything else I can try? Many Thanks, Tania

2 3

RHEL 10 ipa-replica-install failure: MDB_BAD_VALSIZE during initial replication
by Sam Morris 19 May '26

19 May '26

I'm working on replacing my RHEL 9 ipa servers with RHEL 10. I'm having trouble running ipa-replica-install on the RHEL 10 machine. ipa6 is the existing replica, running 389-ds-base-2.7.0-12.el9_7.x86_64 ipa7 will be the new replica, running 389-ds-base-3.1.3-7.el10_1.x86_64 The initial problem is as described in <https://access.redhat.com/solutions/374063>; ipa-replica-install fails on ipa7 with: # ipa-replica-install --setup-dns --auto-forwarder --setup-ca --setup-kra [...] [25/39]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 6 seconds elapsed [ldap://ipa6.example.com:389] reports: Update failed! Status: [Error (-2) connection error: Unknown connection error (-2) - Total update aborted] [error] RuntimeError: Failed to start replication As I understand it, ipa6 is reporting that it's unable to push replication data to ipa7. ipa7's dirsrv error log has: [14/May/2026:08:34:01.024056108 +0000] - NOTICE - NSMMReplicationPlugin - multisupplier_be_state_change - Replica dc=example,dc=com is going offline; disabling replication [14/May/2026:08:34:06.016144780 +0000] - ERR - sasl_io_start_packet - SASL encrypted packet length exceeds maximum allowed limit (length=2097156, limit=2097152). Change the nsslapd-maxsasliosize attribute in cn=config to increase limit. [14/May/2026:08:34:06.020122827 +0000] - ERR - factory_destructor - ERROR bulk import abandoned: conn=6 was closed [14/May/2026:08:34:06.039293730 +0000] - INFO - dbmdb_import_monitor_threads - import userRoot: Import writer thread usage: run: 25.65% read: 38.59% write: 35.50% pause: 0.15% txnbegin: 0.00% txncommit: 0.11% [14/May/2026:08:34:06.187327861 +0000] - INFO - dbmdb_import_monitor_threads - import userRoot: Workers finished; cleaning up... [14/May/2026:08:34:06.190813134 +0000] - INFO - dbmdb_import_monitor_threads - import userRoot: Workers cleaned up. [14/May/2026:08:34:06.192987116 +0000] - ERR - dbmdb_import_run_pass - import userRoot: Thread monitoring returned: -23 [14/May/2026:08:34:06.194912877 +0000] - ERR - dbmdb_public_dbmdb_import_main - import userRoot: Aborting all Import threads... [14/May/2026:08:34:06.196678126 +0000] - ERR - dbmdb_public_dbmdb_import_main - import userRoot: Import threads aborted. [14/May/2026:08:34:06.198682179 +0000] - INFO - dbmdb_public_dbmdb_import_main - import userRoot: Closing files... [14/May/2026:08:34:06.206359538 +0000] - ERR - dbmdb_public_dbmdb_import_main - import userRoot: Import failed. [14/May/2026:08:34:06.208655028 +0000] - INFO - dbmdb_task_finish - userRoot: Finished importing. Exit code is -23 [14/May/2026:08:34:06.624898860 +0000] - ERR - process_bulk_import_op - NULL target sdn So as advised in the knowledge base article, I cleaned up the failing replication agreement on ipa6, reinstalled ipa7 and tried again using a custom dirsrv config file that inreases nsslapd-maxsasliosize nd nsslapd-sasl-max-buffer-size to 5000000. I got the same failure, but with larger numbers: [14/May/2026:09:28:48.090911293 +0000] - ERR - sasl_io_start_packet - SASL encrypted packet length exceeds maximum allowed limit (length=5000004, limit=5000000). Change the nsslapd-maxsasliosize attribute in cn=config to increase limit. So I tried again, this time increasing both nsslapd-maxsasliosize and nsslapd-sasl-max-buffer-size to 8000000. This time ipa-replica-install didn't fail. Instead, the initial replication never completed: # ipa-replica-install --setup-dns --auto-forwarder --setup-ca --setup-kra --dirsrv-config-file=custom.ldif [...] [28/42]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 2736 seconds elapsed^C [error] KeyboardInterrupt: The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information The last lines in the error log are: [14/May/2026:09:39:27.252987013 +0000] - NOTICE - NSMMReplicationPlugin - multisupplier_be_state_change - Replica dc=example,dc=com is going offline; disabling replication [14/May/2026:09:39:33.330868063 +0000] - ERR - dbmdb_import_writer - Failed to write in the database. Error is 0xffff87c3: MDB_BAD_VALSIZE: Unsupported size of key/DB name/data, or wrong DUPFIXED size. [14/May/2026:09:39:33.436983183 +0000] - ERR - dbmdb_import_monitor_threads - import userRoot: thread writer aborted ==> Aborting bulk import. [14/May/2026:09:39:33.442402509 +0000] - ERR - process_bulk_import_op - Failed; error = -1 [14/May/2026:09:39:33.445013557 +0000] - ERR - factory_destructor - ERROR bulk import abandoned: conn=6 was closed [14/May/2026:09:39:33.541001450 +0000] - INFO - dbmdb_import_monitor_threads - import userRoot: Workers finished; cleaning up... [14/May/2026:09:39:33.544698620 +0000] - INFO - dbmdb_import_monitor_threads - import userRoot: Workers cleaned up. [14/May/2026:09:39:33.546954292 +0000] - ERR - dbmdb_import_run_pass - import userRoot: Thread monitoring returned: -23 [14/May/2026:09:39:33.548828730 +0000] - ERR - dbmdb_public_dbmdb_import_main - import userRoot: Aborting all Import threads... [14/May/2026:09:39:33.550942484 +0000] - ERR - dbmdb_public_dbmdb_import_main - import userRoot: Import threads aborted. [14/May/2026:09:39:33.553024072 +0000] - INFO - dbmdb_public_dbmdb_import_main - import userRoot: Closing files... [14/May/2026:09:39:33.557336393 +0000] - ERR - dbmdb_public_dbmdb_import_main - import userRoot: Import failed. [14/May/2026:09:39:33.559553914 +0000] - INFO - dbmdb_task_finish - userRoot: Finished importing. Exit code is -23 At this point the dirsrv process is still running but does not respond to any connections: # timeout 5 ldapsearch -Y EXTERNAL -H ldapi://%2frun%2fslapd-EXAMPLE-COM.socket -s base -b cn=config; echo $? SASL/EXTERNAL authentication started 124 ... nor does it respond to SIGTERM, I have to send SIGKILL to kill it. Summing up: 1. Something in my directory causes LMDB to fail with this error. But I don't know how do debug this further. 2. I think dirsrv hanging after this error is a bug that I can file separately once I've got past the MDB_BAD_VALSIZE error. 3. My database isn't all that large; a dozen users, several dozen hosts and serviecs. I wonder if it's worth increasing the defaults values for nsslapd-maxsasliosize and nsslapd-sasl-max-buffer-size? Assuming the place to request this would be with 389-ds-base I can do that as well. I've done some very preliminary investigation of my directory to maybe see where the problem might be. Taking the LMDB error at face value, and looking at the sizes of the files in the userRoot backend: root@ipa6:~# ls -1sh /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/* --sort=s -r | tail 120K /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/krbPrincipalName.db 128K /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/nsuniqueid.db 168K /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/entryusn.db 360K /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/cn.db 368K /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/memberOf.db 616K /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/member.db 4.1M /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/entryrdn.db 15M /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/id2entry.db 16M /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/userCertificate.db 39M /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/replication_changelog.db ... I've got a couple of ideas: * Maybe I've got too many userCertificate attributes, or one or more of them are too large? * One of my users had a 23 KiB jpegPhoto attribute which I have removed; however maybe it's still in the replication changelog and could therefore continue to cause problems? * It actually looks like <https://redhat.atlassian.net/browse/RHEL-133085> is this issue, in which case I should just wait for RHEL 10.2. As always any advice is appreciated! -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9

1 1

pki-tomcatd cannot start
by Giulio Casella 14 May '26

14 May '26

Hello everyone, on two out of three ipa server of my setup pki-tomcatd refuse to start, giving: SEVERE: LdapBoundConnFactory: Unable to connect to LDAP server: Authentication failed After some quick research I tried to verify tomcat internal password: grep internal /var/lib/pki/pki-tomcat/conf/password.conf | cut -d= -f2 > /tmp/pwdfile.txt The password seems to be ok, but when I try to list keys I get: certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n 'subsystemCert cert-pki-ca' certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" certutil: problem listing keys: SEC_ERROR_INVALID_ALGORITHM: security library: invalid algorithm. (no SEC_ERROR_BAD_PASSWORD message, but SEC_ERROR_INVALID_ALGORITHM) Any ideas? My setup is based on rhel 9.7, fully updated (ipa-server-4.12.2-22.el9_7.4) TIA, Giulio

3 3

freeipa4.3 The 389ds service has crashed due to a pthread_mutex_lock.
by liang fei 13 May '26

13 May '26

The 389ds service has crashed due to a pthread_mutex_lock. Environment: Ubuntu 16.04, FreeIPA 4.3, 389-Directory/1.3.4.9 B2016.109.158 Trigger condition: When Ambari operation concurrently adds five nodes, a new Hadoop keytab file will be added. The 389ds service with a large number of krb clients for authentication and adding service keytab to 389ds Replication will deadlock, while the 389ds service without krb client login is normal. Therefore, this is a pthread_mutex_lock issue of (krb client -> search 389ds) + (add krb service -> 389ds data replica). I understand that Berkeley Database (bdb) has many problems, according to this document: https://www.port389.org/docs/389ds/howto/howto-use-lmdb.html. But I don't understand why the freeipa 4.3 version is so fragile? My current environment is reproducible. Only when adding krb service keytab nodes in batches will it crash. How can I solve this problem in a lightweight way without upgrading the version or replacing bdb? My current solution is to kill ns-slapd and then start-dirsrv. 389ds crashed logs tailf access ``` [29/Apr/2026:14:31:23 +0800] conn=19 op=2735 SRCH base="dc=yydevops,dc=com" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbt... [29/Apr/2026:14:31:25 +0800] conn=67 op=6 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:25 +0800] conn=67 op=6 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:28 +0800] conn=67 op=7 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:28 +0800] conn=67 op=7 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:31 +0800] conn=67 op=9 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:31 +0800] conn=67 op=9 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:34 +0800] conn=67 op=10 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:34 +0800] conn=67 op=10 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:37 +0800] conn=67 op=12 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:37 +0800] conn=67 op=12 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:40 +0800] conn=67 op=13 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:40 +0800] conn=67 op=13 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:43 +0800] conn=67 op=15 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:43 +0800] conn=67 op=15 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:46 +0800] conn=67 op=16 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:46 +0800] conn=67 op=16 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:49 +0800] conn=67 op=18 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:49 +0800] conn=67 op=18 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:52 +0800] conn=67 op=19 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:52 +0800] conn=67 op=19 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:55 +0800] conn=67 op=21 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:55 +0800] conn=67 op=21 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:58 +0800] conn=67 op=22 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:58 +0800] conn=67 op=22 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:32:01 +0800] conn=67 op=24 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:32:01 +0800] conn=67 op=24 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:32:03 +0800] conn=69 fd=95 slot=95 connection from local to /var/run/slapd-YYDEVOPS-COM.socket [29/Apr/2026:14:32:03 +0800] conn=69 op=-1 fd=95 closed - B1 [29/Apr/2026:14:32:03 +0800] conn=70 fd=95 slot=95 connection from local to /var/run/slapd-YYDEVOPS-COM.socket [29/Apr/2026:14:32:03 +0800] conn=70 AUTOBIND dn="cn=Directory Manager" [29/Apr/2026:14:32:03 +0800] conn=70 op=0 BIND dn="cn=Directory Manager" method=sasl version=3 mech=EXTERNAL [29/Apr/2026:14:32:03 +0800] conn=70 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=Directory Manager" [29/Apr/2026:14:32:03 +0800] conn=70 op=1 SRCH base="cn=ipa-70-2.hiido.host.int.yy.com,cn=masters,cn=ipa,cn=etc,dc=yydevops,dc=com" scope=2 filter="(ipaConfigString=enabledService)" attrs="ipaConfigString cn" [29/Apr/2026:14:32:03 +0800] conn=70 op=1 RESULT err=0 tag=101 nentries=6 etime=0 notes=U [29/Apr/2026:14:32:03 +0800] conn=70 op=2 SRCH base="cn=schema" scope=0 filter="(objectClass=*)" attrs="attributeTypes objectClasses" [29/Apr/2026:14:32:03 +0800] conn=70 op=2 RESULT err=0 tag=101 nentries=1 etime=0 [29/Apr/2026:14:32:04 +0800] conn=67 op=25 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:32:04 +0800] conn=67 op=25 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:32:04 +0800] conn=70 op=3 UNBIND [29/Apr/2026:14:32:04 +0800] conn=70 op=3 fd=95 closed - U1 [29/Apr/2026:14:32:07 +0800] conn=67 op=27 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:32:07 +0800] conn=67 op=27 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:32:10 +0800] conn=67 op=28 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:32:10 +0800] conn=67 op=28 RESULT err=0 tag=120 nentries=0 etime=0 ``` gdb_threads.log ``` ....... Thread 34 (Thread 0x7f91757f2700 (LWP 3627)): #0 pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185 #1 0x00007f9333e5384d in __db_pthread_mutex_lock () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #2 0x00007f9333efc66c in __lock_get_internal () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #3 0x00007f9333efd087 in __lock_get () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #4 0x00007f9333f284b7 in __db_lget () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #5 0x00007f9333e7082d in __bam_search () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #6 0x00007f9333e5b8bc in ?? () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #7 0x00007f9333e5d9bf in ?? () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #8 0x00007f9333f14ea5 in __dbc_iget () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #9 0x00007f9333f23f82 in __dbc_get_pp () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #10 0x00007f932fe520ce in idl_new_fetch () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #11 0x00007f932fe60713 in index_read_ext_allids () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #12 0x00007f932fe4ac3d in ?? () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #13 0x00007f932fe4b452 in ?? () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #14 0x00007f932fe4ba3a in filter_candidates_ext () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #15 0x00007f932fe4ca3f in ?? () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #16 0x00007f932fe4b9a2 in filter_candidates_ext () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #17 0x00007f932fe4ca3f in ?? () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #18 0x00007f932fe4b9a2 in filter_candidates_ext () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #19 0x00007f932fe4ca3f in ?? () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #20 0x00007f932fe4b9a2 in filter_candidates_ext () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #21 0x00007f932fe871a7 in subtree_candidates () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #22 0x00007f932fe88733 in ldbm_back_search () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #23 0x00007f933ef1dd90 in op_shared_search () from /usr/lib/x86_64-linux-gnu/dirsrv/libslapd.so.0 #24 0x0000562002c216df in ?? () #25 0x0000562002c1030f in ?? () #26 0x00007f933de7e088 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so #27 0x00007f933da256ba in start_thread (arg=0x7f91757f2700) at pthread_create.c:333 #28 0x00007f933d75b41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 33 (Thread 0x7f9175ff3700 (LWP 3626)): #0 pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185 #1 0x00007f933de786a0 in PR_WaitCondVar () from /usr/lib/x86_64-linux-gnu/libnspr4.so #2 0x0000562002c0e09e in ?? () #3 0x0000562002c0f753 in ?? () #4 0x00007f933de7e088 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so #5 0x00007f933da256ba in start_thread (arg=0x7f9175ff3700) at pthread_create.c:333 #6 0x00007f933d75b41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 32 (Thread 0x7f91767f4700 (LWP 3625)): #0 pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185 #1 0x00007f933de786a0 in PR_WaitCondVar () from /usr/lib/x86_64-linux-gnu/libnspr4.so #2 0x0000562002c0e09e in ?? () #3 0x0000562002c0f753 in ?? () #4 0x00007f933de7e088 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so #5 0x00007f933da256ba in start_thread (arg=0x7f91767f4700) at pthread_create.c:333 #6 0x00007f933d75b41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 31 (Thread 0x7f9176ff5700 (LWP 3624)): #0 pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185 #1 0x00007f933de786a0 in PR_WaitCondVar () from /usr/lib/x86_64-linux-gnu/libnspr4.so #2 0x0000562002c0e09e in ?? () #3 0x0000562002c0f753 in ?? () #4 0x00007f933de7e088 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so #5 0x00007f933da256ba in start_thread (arg=0x7f9176ff5700) at pthread_create.c:333 #6 0x00007f933d75b41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 30 (Thread 0x7f91777f6700 (LWP 3623)): #0 0x00007f933da2a730 in futex_wait (private=<optimized out>, expected=0, futex_word=0x7f92e9eaeb0c) at ../sysdeps/unix/sysv/linux/futex-internal.h:61 #1 futex_wait_simple (private=<optimized out>, expected=0, futex_word=0x7f92e9eaeb0c) at ../sysdeps/nptl/futex-internal.h:135 #2 __pthread_rwlock_wrlock_slow (rwlock=0x7f92e9eaeb00) at pthread_rwlock_wrlock.c:67 #3 0x00007f9333e536d7 in __db_pthread_mutex_lock () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #4 0x00007f9333f6abbb in __memp_fget () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #5 0x00007f9333e70307 in __bam_search () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #6 0x00007f9333e5b8bc in ?? () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #7 0x00007f9333e5fde5 in ?? () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #8 0x00007f9333f158a1 in __dbc_iput () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #9 0x00007f9333f10a25 in __db_put () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #10 0x00007f9333f26593 in __db_put_pp () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #11 0x00007f932fe52f7f in idl_new_insert_key () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #12 0x00007f932fe62174 in ?? () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #13 0x00007f932fe62d04 in index_addordel_values_ext_sv () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #14 0x00007f932fe63161 in index_addordel_values_sv () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #15 0x00007f932fe63217 in index_addordel_entry () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #16 0x00007f932fe65f5a in ldbm_back_add () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #17 0x00007f933eecf6ba in ?? () from /usr/lib/x86_64-linux-gnu/dirsrv/libslapd.so.0 #18 0x00007f933eed0a38 in do_add () from /usr/lib/x86_64-linux-gnu/dirsrv/libslapd.so.0 #19 0x0000562002c103e8 in ?? () #20 0x00007f933de7e088 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so #21 0x00007f933da256ba in start_thread (arg=0x7f91777f6700) at pthread_create.c:333 #22 0x00007f933d75b41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 29 (Thread 0x7f9177ff7700 (LWP 3622)): #0 pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185 #1 0x00007f933de786a0 in PR_WaitCondVar () from /usr/lib/x86_64-linux-gnu/libnspr4.so #2 0x0000562002c0e09e in ?? () #3 0x0000562002c0f753 in ?? () #4 0x00007f933de7e088 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so #5 0x00007f933da256ba in start_thread (arg=0x7f9177ff7700) at pthread_create.c:333 #6 0x00007f933d75b41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 ...... ```

2 1

uname to login
by Frederic Ayrault 12 May '26

12 May '26

Bonjour, I was adding and remove SSH key to do some test when I was loggoff from the GUI and I am not able to loggin anymore. I tried ipa user-mod fred --password and ipa user-mod fred --random, both seems to work, but I am still enable to login When I try to change the password from the GUI using the admin account I get > Erreur IPA 4031: EmptyResult > no matching entry found if I try an kinit fred, I get > kinit: Client 'fred(a)LIX.POLYTECHNIQUE.FR' not found in Kerberos > database while getting initial credentials I did an ldapsearch before loosing access add one difference with now is one object is added > objectClass: ipauserauthtypeclass Do you have any ideas ? Thank you for your help Regards, Frederic Frédéric AYRAULT Administrateur Systèmes et Réseaux Laboratoire d'Informatique de l'Ecole polytechnique <http://www.lix.polytechnique.fr> fred(a)lix.polytechnique.fr

3 2

sss_ssh_knownhosts and an additional ssh server
by Markus Rexhepi-Lindberg 11 May '26

11 May '26

In my $ORG we use IPA sss_ssh_knownhosts together with the KnownHostsCommand ssh_config option for ssh host key validation. /etc/ssh/ssh_config ``` ... KnownHostsCommand /usr/bin/sss_ssh_knownhosts %H ... ``` This works for the system ssh server but it fails for any additional ssh server (with its own set of host keys) running on the host on a different port. ``` $ ssh -p 29418 user(a)server.example.com @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the ED25519 key sent by the remote host is SHA256:edbbuC6wQ67bkP9594r3PL0VFVw9NL8w5KXWS279D5c. Please contact your system administrator. Add correct host key in /home/user/.ssh/known_hosts to get rid of this message. Offending ECDSA key in KnownHostsCommand-HOSTNAME:3 remove with: ssh-keygen -f 'KnownHostsCommand-HOSTNAME' -R '[server.example.com]:29418' Host key for [server.example.com]:29418 has changed and you have requested strict checking. Host key verification failed ``` In this case the ssh server running on port 29418 is used for the Gerrit Code Review service (git). What it the recommended approach for these cases? I would much rather have to accept an unknown host key than have the ssh command fail with a mitm-attack banner. ssh version: ``` $ ssh -V OpenSSH_10.2p1 Ubuntu-2ubuntu3.2, OpenSSL 3.5.5 27 Jan 2026 ``` sssd version: ``` $ sssd --version 2.12.0 ```

2 3

configure ipa-healthcheck?
by lejeczek 08 May '26

08 May '26

I see there is a config file and I searched, but failed to find an info on how to, ideally permanently, tell ipa-healthcheck what is the threshold for filesystem - do you now? thanks, L.

4 3

Configuring clients via ansible in debian 13 - misconfigured sssd systemd services
by Aram Akhavan 07 May '26

07 May '26

Working on getting hosts joined with ansible. I set up a fresh debian 13 VM and used the ansible role to run client install. No issues joining and I can log in just fine. Everything seems to work. On reboot, though, I notice some systemd issues: sssd_check_socket_activated_responders[675]: Misconfiguration found for the 'nss' responder. It has been configured to be socket-activated but it's still mentioned in the services' line of the config file. Please consider either adjusting services' line or disabling the socket by calling: "systemctl disable sssd-nss.socket" The same shows for the other services. And indeed, the sssd.conf file set up by the client install has: [sssd] services = nss, pam, ssh, sudo Quick search shows that this is in ipaclient/install/client.py, though its used by the ansible module too. I guess the solution is to update my own role to disable the socket responders?

3 4

SubCA and certmonger
by Olivier G 06 May '26

06 May '26

Hi all, I have try to sign a certificate with my subCA but I failed each time (with the 'ipa-getcert request' command). Digging the issue, I have been surprised to discover that certmonger does not 'see' a subCA created with 'ipa ca-add' command. The SubCA does not appears in the 'getcert list-cas' command list but it appears in the 'ipa ca-find' command list. Am I doing a mistake ? Is there any way to create subCAs that are visible to certmonger ? What should I do ? Is it possible to configure the certmonger renewal time ( it seems to fixed) ? Otherwise what is the recommended workaround ? Is it to develop a (not so simple I guess) in-house certmonger like ? Thanks for reading Olivier Linux 5.14.0-427.13.1.el9_4.x86_64 VERSION: 4.11.0, API_VERSION: 2.253

3 2

Rocky10 and libfido2
by ian willis 04 May '26

04 May '26

Hi All, We were/are looking at using the token2 Token2 PIN+Bio3 FIDO2 Security Key with Biometric Authentication (dongle) with a PIN+ FIDO2 NFC and Contact Card as a backup credential (smartcard) in combination with freeipa for some Rocky10 desktops. After trying to get the smartcard working I realised that the libfido2 1.14.0 was built without PS/SC support. Prior to rebuilding and repacking this in a custom repo, I was wondering if this was a reasonable approach? Is this likely to work with Freeipa validating the smartcard as a FIDO2 credential? We use Dell Pro Smartcard Keyboard - KB813 - US English so readers aren't an issue and we were considering the smartcards as a break glass fallback however it appears to have fallen at the first hurdle. I like the biometric approach of the dongle however in the longer run we'll move to biometric dongle and smartcard with biometric backup. But smartcards on linux always appear to be fiddly.

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2026