FreeIPA-users

freeipa-users@lists.fedorahosted.org

6 participants
4844 discussions

Demo freeipa server authentication failure
by Jaquiel Paim 17 Feb '26

17 Feb '26

I'm getting "The password or username you entered is incorrect" using the credentials from the wiki to access: https://ipa.demo1.freeipa.org/ipa/ui/: https://www.freeipa.org/page/Demo I'm getting "401 Unauthorized" consuming https://ipa.demo1.freeipa.org/ipa through https.

3 3

Unable to acquire replica: error: permission denied
by liang fei 13 Feb '26

13 Feb '26

For the previous issue, I was at a loss and took a risky action by executing the command "ipa-replica-manage re-initialize --from xx". However, there are issues with permission authentication between the freeipa4.8 versions. Since freeipa4.8 is currently mainly designed for client-side authentication with the kdc, it is very important and cannot perform the ipa-replica-manage re-initialize operation. What should I do to fix this permission issue? They were previously able to authenticate each other. However, I'm not sure if this was affected by the changes made there. root@fs-hiido-kerberos-server03:/home/liangrui06# ldapsearch -LLL -x -H ldap://localhost:389 -D "cn=Directory Manager" -w $pass -b "cn=replica,cn=dc\3Dxx\2Cdc\3Dcom,cn=mapping tree,cn=config" "(objectClass=nsds5ReplicationAgreement)" cn nsDS5ReplicaHost nsds5replicaLastUpdateStatus dn: cn=fs-hiido-kerberos-server03.hiido.host.xx.com-to-fs-hiido-kerberos -server04.hiido.host.xx.com,cn=replica,cn=dc\3Dxx\2Cdc\3Dcom,cn=m apping tree,cn=config cn: fs-hiido-kerberos-server03.hiido.host.xx.com-to-fs-hiido-kerberos-se rver04.hiido.host.xx.com nsDS5ReplicaHost: fs-hiido-kerberos-server04.hiido.host.xx.com nsds5replicaLastUpdateStatus: Error (1) Can't acquire busy replica (Unable to acquire replica: the replica is currently being updated by another supplier.) dn: cn=meTofs-hiido-kerveros-test08.hiido.host.xx.com,cn=replica,cn=dc\3 Dxx\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-kerveros-test08.hiido.host.xx.com nsDS5ReplicaHost: fs-hiido-kerveros-test08.hiido.host.xx.com nsds5replicaLastUpdateStatus: Error (3) Replication error acquiring replica: U nable to acquire replica: permission denied. The bind dn does not have permis sion to supply replication updates to the replica. Will retry later. (permiss ion denied) root@fs-hiido-kerveros-test08:~# ldapsearch -LLL -x -H ldap://localhost:389 -D "cn=Directory Manager" -w $pass -b "cn=replica,cn=dc\3Dxx\2Cdc\3Dcom,cn=mapping tree,cn=config" "(objectClass=nsds5ReplicationAgreement)" cn nsDS5ReplicaHost nsds5replicaLastUpdateStatus dn: cn=fs-hiido-kerveros-test08.hiido.host.xx.com-to-fs-hiido-ipa-65-155 .hiido.host.xx.com,cn=replica,cn=dc\3Dxx\2Cdc\3Dcom,cn=mapping tr ee,cn=config cn: fs-hiido-kerveros-test08.hiido.host.xx.com-to-fs-hiido-ipa-65-155.hi ido.host.xx.com nsDS5ReplicaHost: fs-hiido-ipa-65-155.hiido.host.xx.com nsds5replicaLastUpdateStatus: Error (0) Replica acquired successfully: Increme ntal update succeeded dn: cn=fs-hiido-kerveros-test08.hiido.host.xx.com-to-fs-hiido-kerberos-2 1-117-149.hiido.host.xx.com,cn=replica,cn=dc\3Dxx\2Cdc\3Dcom,cn=m apping tree,cn=config cn: fs-hiido-kerveros-test08.hiido.host.xx.com-to-fs-hiido-kerberos-21-1 17-149.hiido.host.xx.com nsDS5ReplicaHost: fs-hiido-kerberos-21-117-149.hiido.host.xx.com nsds5replicaLastUpdateStatus: Error (0) Replica acquired successfully: Increme ntal update succeeded dn: cn=meTofs-hiido-kerberos-server02.hiido.host.xx.com,cn=replica,cn=dc \3Dxx\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-kerberos-server02.hiido.host.xx.com nsDS5ReplicaHost: fs-hiido-kerberos-server02.hiido.host.xx.com nsds5replicaLastUpdateStatus: Error (-2) Problem connecting to replica - LDAP error: Local error (connection error) dn: cn=meTofs-hiido-kerberos-server03.hiido.host.xx.com,cn=replica,cn=dc \3Dxx\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-kerberos-server03.hiido.host.xx.com nsDS5ReplicaHost: fs-hiido-kerberos-server03.hiido.host.xx.com nsds5replicaLastUpdateStatus: Error (49) Problem connecting to replica - LDAP error: Invalid credentials (connection error) fs-hiido-kerberos-server03 ->meTofs-hiido-kerveros-test08.hiido.host.xx.com What kind of permission is lacking between them? root@fs-hiido-kerveros-test08:/var/log/dirsrv/slapd-YYDEVOPS-COM# tailf errors [29/Jan/2026:15:04:49.513109345 +0800] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=7195 op=90315 replica="dc=xx,dc=com": Unable to acquire replica: error: permission denied [29/Jan/2026:15:04:52.509637825 +0800] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=7195 op=90317 replica="dc=xx,dc=com": Unable to acquire replica: error: permission denied [29/Jan/2026:15:04:55.827408548 +0800] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=7195 op=90318 replica="dc=xx,dc=com": Unable to acquire replica: error: permission denied

1 3

dhcp using ldap, implementation using freeradius
by Charles Hedrick 12 Feb '26

12 Feb '26

ISC EOL'ed dhcpd a few years ago. We have been using it for DHCP, with LDAP as a data source. The advantage of LDAP is that it's a replicated database. Setting up a replicated SQL is non-trivial. We don't use dynamic DHCP, because wireless is handled by the University for us. So LDAP is a great source. Unfortunately ISC's replacement, KEA, aside from being complex and not entirely open source, doesn't support LDAP. So we're moving to Freeradius, which has a reasonable DHCP implementation. The following has our implementation: https://github.com/clhedrick/kerberos/tree/master/freeradius-dhcp. Getting freeradius to do DHCP against LDAP is quite straightforward, but took a lot of work to figure out, in part because of sketchy documentation. This is for the current production version of freeradius, 3. I'll modify it for version 4 when that is released. It's a few configuration files for freeradius, and dhcp.py, which goes into ipaserver/plugins to enable IPA to manage DHCP information. I should note that while dhcp.py has the whole DHCP schema, it's not clear that anything other than the main config, subnets and hosts actually work, since that's all we use. I need a new objectclass with integer versions of IP addresses for subnets and hosts. Those are set up by the IPA commands and used by the DHCP implementation. The ldif subdirectory has them. The problem is that when a request comes in I need to find the subnet it's part of. LDAP can't compare IP addresses, so I need the integer version to use in a search filter. That's the reason for the new objectclass.

1 0

WEB UI group membership not working Almalinux9/10. Freeipa 4.12.2
by Alex I 11 Feb '26

11 Feb '26

Hello, I'm trying to get groups membership working on freeipa 4.12.2 (tried fresh install on Almalinux 9 and 10). I can add/remove users to/from a group in CLI, but web UI has 'Add' button in group membership pop-up greyed out. I get httpd error 'failed to set perms (3140) on file (/run/ipa/ccaches/admin(a)mydomain.COM-9UR3mc)' and playing with directory ownership gets me nowhere. Any advise? Thanks

3 4

The remote replica has a different database generation ID than the local database
by liang fei 28 Jan '26

28 Jan '26

I encountered a problem where multiple services had duplicate brain splits. There were two replication protocols that overlapped with each other. How can I delete the incorrect replication of the database generation ID? I don't want to do "reinitialize" as it would result in data loss. env ``` ubuntu16.04 CA freeipa4.3 fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com freeipa4.8 fs-hiido-kerveros-test08.hiido.host.yydevops.com ``` ssh fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com ``` root@fs-hiido-kerberos-21-117-149:/var/log/dirsrv/slapd-YYDEVOPS-COM# ldapsearch -LLL -x -H ldap://localhost:389 -D "cn=Directory Manager" -w xx -b "cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=mapping tree,cn=config" "(objectClass=nsds5ReplicationAgreement)" cn nsDS5ReplicaHost nsds5replicaLastUpdateStatus dn: cn=fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com-to-fs-hiido-kerver os-test08.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=m apping tree,cn=config cn: fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com-to-fs-hiido-kerveros- test08.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-kerveros-test08.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 402 Replication error acquiring replica: unknown error - Replica has different database generation ID, remote replica may nee d to be initialized dn: cn=meTofs-hiido-ipa-65-155.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyyde vops\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-ipa-65-155.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-ipa-65-155.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental upd ate succeeded dn: cn=meTofs-hiido-kerberos-ca-02.hiido.host.yydevops.com,cn=replica,cn=dc\3D yydevops\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-kerberos-ca-02.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-kerberos-ca-02.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental upd ate succeeded dn: cn=meToipa-65-189.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyydevops\2Cdc \3Dcom,cn=mapping tree,cn=config cn: meToipa-65-189.hiido.host.yydevops.com nsDS5ReplicaHost: ipa-65-189.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental upd ate succeeded root@fs-hiido-kerberos-21-117-149:/var/log/dirsrv/slapd-YYDEVOPS-COM# ``` ssh fs-hiido-kerveros-test08.hiido.host.yydevops.com ``` error log [28/Jan/2026:18:22:13.802652193 +0800] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=fs-hiido-kerveros-test08.hiido.host.yydevops.com-to-fs-hiido-kerberos-21…" (fs-hiido-kerberos-21-117-149:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. [28/Jan/2026:18:22:14.825827647 +0800] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=fs-hiido-kerveros-test08.hiido.host.yydevops.com-to-fs-hiido-ipa-65-155.…" (fs-hiido-ipa-65-155:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. root@fs-hiido-kerveros-test08:~# cat ref_149.ldif dn: cn=fs-hiido-kerveros-test08.hiido.host.yydevops.com-to-fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=mapping tree,cn=config changetype: modify add: nsds5BeginReplicaRefresh nsds5BeginReplicaRefresh: start ldapmodify -H ldap://localhost:389 -Y GSSAPI -f 149_reinit.ldif root@fs-hiido-kerveros-test08:/var/log/dirsrv/slapd-YYDEVOPS-COM# ldapsearch -LLL -x -H ldap://localhost:389 -D "cn=Directory Manager" -w ipaadmin4yycluster -b "cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=mapping tree,cn=config" "(objectClass=nsds5ReplicationAgreement)" cn nsDS5ReplicaHost nsds5replicaLastUpdateStatus dn: cn=fs-hiido-kerveros-test08.hiido.host.yydevops.com-to-fs-hiido-ipa-65-155 .hiido.host.yydevops.com,cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=mapping tr ee,cn=config cn: fs-hiido-kerveros-test08.hiido.host.yydevops.com-to-fs-hiido-ipa-65-155.hi ido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-ipa-65-155.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: Error (0) Replica acquired successfully: Increme ntal update succeeded dn: cn=fs-hiido-kerveros-test08.hiido.host.yydevops.com-to-fs-hiido-kerberos-2 1-117-149.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=m apping tree,cn=config cn: fs-hiido-kerveros-test08.hiido.host.yydevops.com-to-fs-hiido-kerberos-21-1 17-149.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: Error (0) Replica acquired successfully: Increme ntal update succeeded ``` ssh fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com ``` root@fs-hiido-kerberos-21-117-149:/var/log/dirsrv/slapd-YYDEVOPS-COM# ldapsearch -LLL -x -H ldap://localhost:389 -D "cn=Directory Manager" -w ipaadmin4yycluster -b "cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=mapping tree,cn=config" "(objectClass=nsds5ReplicationAgreement)" cn nsDS5ReplicaHost nsds5replicaLastUpdateStatus dn: cn=fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com-to-fs-hiido-kerver os-test08.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=m apping tree,cn=config cn: fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com-to-fs-hiido-kerveros- test08.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-kerveros-test08.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental upd ate succeeded dn: cn=meTofs-hiido-ipa-65-155.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyyde vops\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-ipa-65-155.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-ipa-65-155.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental upd ate succeeded dn: cn=meTofs-hiido-kerberos-ca-02.hiido.host.yydevops.com,cn=replica,cn=dc\3D yydevops\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-kerberos-ca-02.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-kerberos-ca-02.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 1 Can't acquire busy replica dn: cn=meToipa-65-189.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyydevops\2Cdc \3Dcom,cn=mapping tree,cn=config cn: meToipa-65-189.hiido.host.yydevops.com nsDS5ReplicaHost: ipa-65-189.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 402 Replication error acquiring replica: unknown error - Replica has different database generation ID, remote replica may nee d to be initialized dn: cn=meToipa-65-189.hiido.host.yydevops.com... changetype: modify add: nsds5BeginReplicaRefresh nsds5BeginReplicaRefresh: start ldapmodify -H ldap://localhost:389 -Y GSSAPI -f 189_reinit.ldif root@fs-hiido-kerberos-21-117-149:~# ldapsearch -LLL -x -H ldap://localhost:389 -D "cn=Directory Manager" -w ipaadmin4yycluster -b "cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=mapping tree,cn=config" "(objectClass=nsds5ReplicationAgreement)" cn nsDS5ReplicaHost nsds5replicaLastUpdateStatus dn: cn=fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com-to-fs-hiido-kerver os-test08.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=m apping tree,cn=config cn: fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com-to-fs-hiido-kerveros- test08.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-kerveros-test08.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 402 Replication error acquiring replica: unknown error - Replica has different database generation ID, remote replica may nee d to be initialized dn: cn=meTofs-hiido-ipa-65-155.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyyde vops\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-ipa-65-155.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-ipa-65-155.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental upd ate succeeded dn: cn=meTofs-hiido-kerberos-ca-02.hiido.host.yydevops.com,cn=replica,cn=dc\3D yydevops\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-kerberos-ca-02.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-kerberos-ca-02.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental upd ate succeeded dn: cn=meToipa-65-189.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyydevops\2Cdc \3Dcom,cn=mapping tree,cn=config cn: meToipa-65-189.hiido.host.yydevops.com nsDS5ReplicaHost: ipa-65-189.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental upd ate succeeded ```

1 0

FOSDEM 2026 and FreeIPA/SSSD presence
by Alexander Bokovoy 26 Jan '26

26 Jan '26

Hi, this upcoming weekend the largest free software event in Europe will happen in Brussels, Belgium: https://fosdem.org/. FreeIPA, SSSD, and a lot of other free software projects will be present there. If you are at FOSDEM, make sure to meet your fellow free software developers. On Saturday, January 31st, we will run a demo stand for the first time: https://fosdem.org/2026/stands/ "Sovereign Identity for server, desktop, and a cloud Keycloak, FreeIPA, SSSD, OpenWallet (SAT)" The stand will be available from 10:00 to 19:00, at building K, level 1, group C (System Administration). At this stand you will have an opportunity to meet FreeIPA, SSSD, and Keycloak developers. We hope to demonstrate various integration scenarios, including latest desktop integration effort done together with GNOME folks. On Sunday, Identity and Access Management devroom will be run from 9:00 to 17:00 at room H.2214: https://fosdem.org/2026/schedule/track/identity-and-access-management/ If you aren't in Brussels, all talks will be streamed online and recordings will be published later as well. However, meeting in person is something that FOSDEM is the best for, together with waffles and a local beer. See you all there! -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

HTTP returns non-2xx status code
by Tania Hagan 26 Jan '26

26 Jan '26

Hi freeipa-users, We're currently using Freeipa version 4.11.0 on Rocky 9.4 with Apache/2.4.57 and every so often our HTTP fails with our monitoring returning non-2xx status code. Looking at the error log for httpd I see: [mpm_event:error] [pid 1800:tid 1800] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase ServerLimit. Researching this error, it appears to recommend adding to the httpd configuration https://forum.directadmin.com/threads/ah03490-scoreboard-is-full-note-at-ma…. Has anyone had to do this or can recommend a "freeipa" way to resolve this? (Reluctant to mess around with the httpd configuration as unsure on the effects of the client connections with freeipa) Many Thanks, Tania

3 6

[SSSD] Announcing SSSD 2.9.8
by Pavel Březina 21 Jan '26

21 Jan '26

# SSSD 2.9.8 The SSSD team is announcing the release of version 2.9.8 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.9.8 See the full release notes at: https://sssd.io/release-notes/sssd-2.9.8.html While we plan to maintain this branch providing critical bug fixes upstream, we don't commit to regular releases off this branch going forward. We recommend switching to the latest upstream release 2.12.0. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users # SSSD 2.9.8 Release Notes ## Highlights ### General information * After startup SSSD already creates a Kerberos configuration snippet typically in /var/lib/sss/pubconf/krb5.include.d/localauth_plugin if the AD or IPA providers are used. This enables SSSD's localauth plugin. Starting with this release the an2ln plugin is disabled in the configuration snippet as well. If this file or its content are included in the Kerberos configuration it will fix CVE-2025-11561. ### Configuration changes * An option `ipa_enable_dns_sites`, that never worked due to missing server side implementation, was removed. * The default value of session_provider option was changed to none (i.e. disabled) no matter what id_provider used. Previously session_provider was enabled by default for id_provider = ipa case. The primary tool it was intended to support, “Fleet Commander,” has become obsolete. * The option `ipa_subid_ranges_search_base` was deprecated in favor of `ldap_subid_ranges_search_base`.

1 0

Re: IPA users/groups are gone after a second reboot
by Sven Jansen 20 Jan '26

20 Jan '26

Hi, I see the same problem on my IPA installations for around one or two weeks now. All affected machines run FreeIPA 4.9.13-20. * one machine is a RHEL 8.10 standalone deployment * two machines are AlmaLinux 8.10 sync between each other * All instances have the full capability, DNS, Certificate Authority and acme. These installations are not related and in different companys. On the first RHEL machine, users are listed, groups are not, some other object types are missing, you can find objects by searching for the name, same with ipa find-user. Fresh created users/group/hosts work fine and show up in Web interface and ipa find-user. On the second pair (running AlmaLinux), its a bit different, no users, groups, hosts, sudo rules etc. are shown, only fresh created objects show up by using the Web interface or using ipa command. DNS is a bit different, on IPA1, all DNS zones are visible, on IPA2, no zones are visible, except i create a new zone. Luckly i still can see all zones on IPA1. Searching for DNS zones on IPA2 does not work, but i can reach the zone by changing the url to “/ipa/ui/#/e/dnszone/records/mydomain.com” on IPA2, so they are there and accessible. I tried to edit existing objects to see if they pop up, but no luck. I ran ipa-server-upgrade to see if some migration is missing, but it finish without issue and the problem persist. No issues with DNS lookups, getting certs or provide authentication, just searching/showing objects is broken I have no clue how to fix that, i can see no “useful” information in my slapd logs or i dont know what to lock for.

4 7

Freeipa schema issue and replication
by M D 19 Jan '26

19 Jan '26

I inherited a freeipa cluster, hand cranked and all of that. For some reason, the wrong schema was replicated from a bad server that I was trying to add to the cluster using ipa-replica-install to a working one. 10% of ipa servers are left and I am afraid I may lose them. Before this disaster, a coworker was upgrading freeipa servers using with --skip-version-check. Some servers have 4.9.13-12.module+el8, others have 4.9.13-18.module+el8. the following is a snippet of multiple error lines ERR - NSACLPlugin - __aclp__init_targetattr - targetattr > “ipauserdefaultsubordinateid” does not exist in schema. Please add > attributeTypes “ipauserdefaultsubordinateid” to schema if necessary. > ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE > ERR(rv=-5): (targetattr = "cn > ERR - NSACLPlugin - __aclinit_handler - This ((targetattr = “cn || > createtimestamp || entryusn || ipacertificatesubjectbase || ipaconfigstring > || ipacustomfields || ipadefaultemaildomain || ipadefaultloginshell || > ipadefaultprimarygroup || ipadomainresolutionorder || ipagroupobjectclasses > || ipagroupsearchfields || ipahomesrootdir || ipakrbauthzdata || > ipamaxhostnamelength || ipamaxusernamelength || ipamigrationenabled || > ipapwdexpadvnotify || ipasearchrecordslimit || ipasearchtimelimit || > ipaselinuxusermapdefault || ipaselinuxusermaporder || ipauserauthtype || > ipauserdefaultsubordinateid || ipauserobjectclasses || ipausersearchfields > || modifytimestamp || objectclass”)(targetfilter = > “(objectclass=ipaguiconfig)”)(version 3.0;acl “permission:System: Read > Global Configuration”;allow (compare,read,search) userdn = “ldap:///all”;)) > ACL will not be considered for evaluation because of syntax errors. > ERR - NSACLPlugin - __aclp__init_targetattr - targetattr > “ipaautoprivategroups” does not exist in schema. Please add attributeTypes > “ipaautoprivategroups” to schema if necessary. > ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE > ERR(rv=-5): (targetattr = "cn > ERR - NSACLPlugin - __aclinit_handler - This ((targetattr = “cn || > createtimestamp || entryusn || ipaautoprivategroups || ipabaseid || > ipabaserid || ipaidrangesize || ipanttrusteddomainsid || iparangetype || > ipasecondarybaserid || modifytimestamp || objectclass”)(targetfilter = > “(objectclass=ipaidrange)”)(version 3.0;acl “permission:System: Read ID > Ranges”;allow (compare,read,search) userdn = “ldap:///all”;)) ACL will not > be considered for evaluation because of syntax errors. > WARN - NSACLPlugin - acl_parse - The ACL target cn=automember rebuild > membership,cn=tasks,cn=config does not exist > INFO - slapi_vattrspi_regattr - Because krbPwdPolicyReference is a new > registered virtual attribute , nsslapd-ignore-virtual-attrs was set to ‘off’ > ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Password > Policy,cn=accounts,dc=example,dc=com–no CoS Templates found, which should > be added before the CoS Definition. I am not sure where to begin, I am kind of lost. Help is appreciated.

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users