FreeIPA-users January 2026

freeipa-users@lists.fedorahosted.org

12 participants
14 discussions

EL9 IPA servers hanging on shutdown
by Orion Poplawski 25 Aug '26

25 Aug '26

We're seeing our EL9 IPA server VMs get stuck often at: A stop job is running for Identity, Policy, Audit Is anyone else seeing this? How can I avoid it? -- Orion Poplawski he/him/his - surely the least important thing about me IT Systems Manager 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

2 2

Best way to upgrade FreeIpa version and OS
by Youssef CHTOUROU 27 Jul '26

27 Jul '26

Hello I've 3 FreeIpa Servers (version =4.6.8) runned on Centos 7. I'am looking for upgrade these servers like that : Centos 7 to Rocky 8 FreeIpa server to most recent version possible I would like to see your advice : what is the best / secure way to do this upgrade ? Thanks a lot

2 1

Authenticate users with yubikeys without importing the certificate in IPA does not work.
by Theodor Vallier 23 Apr '26

23 Apr '26

Hello, I'm trying to allow authentication using Yubikeys on clients without importing user's certificates in idM. I use an external PKI that signs everything, so I have the root CA and one sub CA named piv that signs users' csr (that are stored in yubikeys). On the server, the output of ipa-advise config-server-for-smart-card-auth is executed and the output of ipa-advise config-client-for-smart-card-auth is also executed on the client. I added both the certificate mapping rule and the certificate mapping data (Issuer and subject) according to red hat documentation. Steps to Reproduce: In an internet forbidden environment, using at least three VMs on RHEL9. One for IPA, one as a workstation and one that will be the DHCP, DNS and NTP server. Once the DNS and DHCP are configured, I generated a root CA and two sub CAs, one for signing users csr (piv) and one for signing everything else (like ipa). Once ipa is installed with an external ca, I executed the output of ipa-advise config-server-for-smart-card-auth to load and configure ipa for smartcard. Then I added the Certificate Identity Mapping Rule: Mapping rule: (ipacertmapdata=X509:<I\>{issuer\_dn!nss\_x500}<S>{subject_dn!nss_x500}) Matching rule: <ISSUER>CN=piv,C=FR Once the client is registered in ipa, I executed the output of ipa-advise config-client-for-smart-card-auth to load and configure the client for smartcard. Then, I registered a new user, with pkinit enable and I created a Certificate mapping data for him with the good Subject and the same Issuer as the Certificate Identity Mapping Rule. Finally, I set up the yubikey for the corresponding user using the PKI and signed his certificate with the piv CA. Actual behavior: If the user certificate is not present in ipa, I'm prompted to enter the PIN CODE (the Yubikey is recognized and the user is automatically selected), but then I have the error "Sorry, smart card authentication didn't work, please try again". On ipa server, if I use the command ipa certmap-match <user-certificate>, no users are found. Furthermore, in sssd I can see that the server is trying to find a user with the certificate stored on the yubikey instead of trying to check if the certificate is valid and signed by the piv sub CA. Expected behavior: I would expect to be logged in. Version/Release/Distribution: ipa-server-4.10.1-9.el9_2.x86_64 ipa-client-4.10.1-9.el9_2.x86_64 389-ds-base-2.2.4-5.el9_2.x86_64 krb5-server-1.20.1-9.el9_2.x86_64 sssd-2.8.2-3.el9_2.x86_64 Additional info: I can provide more logs if necessary but don't know which ones you could want. Thanks Whidix

3 4

Authentication failure using FreeIPA with Debian13
by kev dog 30 Mar '26

30 Mar '26

Thanks for any help. I'm using Debian 13 Trixie within a Proxmox LXC as a FreeIPA client. My FreeIPA server is run on Fedora 42. My IPA server version is VERSION: 4.12.5, API_VERSION: 2.254. I went through setting up freeipa-client on Debian. I have a working Arch Linux installation as another freeipa client and I compared a lot of the configuration with krb5.conf and sssd.conf to the working configuration. After working through the installation if I try to login as a FreeIPA user I get the following: $ su jax Password: su: Authentication failure At first glance I thought this immediately as a error related to PAM, however I checked the PAM modules files and found I have the following: $grep -R sss /etc/pam.d/ /etc/pam.d/common-session:session optional pam_sss.so /etc/pam.d/common-account:account [default=bad success=ok user_unknown=ignore] pam_sss.so /etc/pam.d/common-password:password sufficient pam_sss.so use_authtok /etc/pam.d/common-auth:auth [success=1 default=ignore] pam_sss.so use_first_pass My arch linux pam.d files were a lot different so I really couldn't compare the structure. I've confirmed I get a kerberos ticket issued for my pam user: $ kinit jax Password for jax@<DOMAIN>.COM: $ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: jax@<DOMAIN>.COM Valid starting Expires Service principal 10/19/2025 00:08:10 10/19/2025 23:53:28 krbtgt/DOMAIN(a)DOMAIN.COM I'm not sure where to look as journalctl isn't exactly helpful: $ sudo journalctl -g pam -b ... Oct 18 23:46:37 traefik.domain.com su[520]: pam_unix(su:auth): authentication failure; logname=kevdog uid=1000 euid=0 tty=/dev/pts/3 ruser=kevdog rhost= user=jax Oct 18 23:46:37 traefik.domain.com su[520]: pam_sss(su:auth): authentication failure; logname=kevdog uid=1000 euid=0 tty=/dev/pts/3 ruser=kevdog rhost= user=jax Oct 18 23:46:37 traefik.domain.com su[520]: pam_sss(su:auth): received for user jax: 4 (System error) For reference my sssd.conf if below: [domain/domain.com] id_provider = ipa ipa_server = ipa.domain.com ipa_domain = domain.com ipa_hostname = traefik.domain.com sudo_provider = ipa auth_provider = ipa chpass_provider = ipa access_provider = permit cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt krb5_store_password_if_offline = True ldap_schema = ipa ldap_group_member = member enumerate = True default_shell = /usr/bin/bash use_fully_qualified_names = False fallback_homedir = /home/%u [sssd] services = nss, pam, ssh, sudo domains = domain.com [nss] homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp] [session_recording]

3 2

Unable to acquire replica: error: permission denied
by liang fei 13 Feb '26

13 Feb '26

For the previous issue, I was at a loss and took a risky action by executing the command "ipa-replica-manage re-initialize --from xx". However, there are issues with permission authentication between the freeipa4.8 versions. Since freeipa4.8 is currently mainly designed for client-side authentication with the kdc, it is very important and cannot perform the ipa-replica-manage re-initialize operation. What should I do to fix this permission issue? They were previously able to authenticate each other. However, I'm not sure if this was affected by the changes made there. root@fs-hiido-kerberos-server03:/home/liangrui06# ldapsearch -LLL -x -H ldap://localhost:389 -D "cn=Directory Manager" -w $pass -b "cn=replica,cn=dc\3Dxx\2Cdc\3Dcom,cn=mapping tree,cn=config" "(objectClass=nsds5ReplicationAgreement)" cn nsDS5ReplicaHost nsds5replicaLastUpdateStatus dn: cn=fs-hiido-kerberos-server03.hiido.host.xx.com-to-fs-hiido-kerberos -server04.hiido.host.xx.com,cn=replica,cn=dc\3Dxx\2Cdc\3Dcom,cn=m apping tree,cn=config cn: fs-hiido-kerberos-server03.hiido.host.xx.com-to-fs-hiido-kerberos-se rver04.hiido.host.xx.com nsDS5ReplicaHost: fs-hiido-kerberos-server04.hiido.host.xx.com nsds5replicaLastUpdateStatus: Error (1) Can't acquire busy replica (Unable to acquire replica: the replica is currently being updated by another supplier.) dn: cn=meTofs-hiido-kerveros-test08.hiido.host.xx.com,cn=replica,cn=dc\3 Dxx\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-kerveros-test08.hiido.host.xx.com nsDS5ReplicaHost: fs-hiido-kerveros-test08.hiido.host.xx.com nsds5replicaLastUpdateStatus: Error (3) Replication error acquiring replica: U nable to acquire replica: permission denied. The bind dn does not have permis sion to supply replication updates to the replica. Will retry later. (permiss ion denied) root@fs-hiido-kerveros-test08:~# ldapsearch -LLL -x -H ldap://localhost:389 -D "cn=Directory Manager" -w $pass -b "cn=replica,cn=dc\3Dxx\2Cdc\3Dcom,cn=mapping tree,cn=config" "(objectClass=nsds5ReplicationAgreement)" cn nsDS5ReplicaHost nsds5replicaLastUpdateStatus dn: cn=fs-hiido-kerveros-test08.hiido.host.xx.com-to-fs-hiido-ipa-65-155 .hiido.host.xx.com,cn=replica,cn=dc\3Dxx\2Cdc\3Dcom,cn=mapping tr ee,cn=config cn: fs-hiido-kerveros-test08.hiido.host.xx.com-to-fs-hiido-ipa-65-155.hi ido.host.xx.com nsDS5ReplicaHost: fs-hiido-ipa-65-155.hiido.host.xx.com nsds5replicaLastUpdateStatus: Error (0) Replica acquired successfully: Increme ntal update succeeded dn: cn=fs-hiido-kerveros-test08.hiido.host.xx.com-to-fs-hiido-kerberos-2 1-117-149.hiido.host.xx.com,cn=replica,cn=dc\3Dxx\2Cdc\3Dcom,cn=m apping tree,cn=config cn: fs-hiido-kerveros-test08.hiido.host.xx.com-to-fs-hiido-kerberos-21-1 17-149.hiido.host.xx.com nsDS5ReplicaHost: fs-hiido-kerberos-21-117-149.hiido.host.xx.com nsds5replicaLastUpdateStatus: Error (0) Replica acquired successfully: Increme ntal update succeeded dn: cn=meTofs-hiido-kerberos-server02.hiido.host.xx.com,cn=replica,cn=dc \3Dxx\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-kerberos-server02.hiido.host.xx.com nsDS5ReplicaHost: fs-hiido-kerberos-server02.hiido.host.xx.com nsds5replicaLastUpdateStatus: Error (-2) Problem connecting to replica - LDAP error: Local error (connection error) dn: cn=meTofs-hiido-kerberos-server03.hiido.host.xx.com,cn=replica,cn=dc \3Dxx\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-kerberos-server03.hiido.host.xx.com nsDS5ReplicaHost: fs-hiido-kerberos-server03.hiido.host.xx.com nsds5replicaLastUpdateStatus: Error (49) Problem connecting to replica - LDAP error: Invalid credentials (connection error) fs-hiido-kerberos-server03 ->meTofs-hiido-kerveros-test08.hiido.host.xx.com What kind of permission is lacking between them? root@fs-hiido-kerveros-test08:/var/log/dirsrv/slapd-YYDEVOPS-COM# tailf errors [29/Jan/2026:15:04:49.513109345 +0800] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=7195 op=90315 replica="dc=xx,dc=com": Unable to acquire replica: error: permission denied [29/Jan/2026:15:04:52.509637825 +0800] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=7195 op=90317 replica="dc=xx,dc=com": Unable to acquire replica: error: permission denied [29/Jan/2026:15:04:55.827408548 +0800] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=7195 op=90318 replica="dc=xx,dc=com": Unable to acquire replica: error: permission denied

1 3

The remote replica has a different database generation ID than the local database
by liang fei 28 Jan '26

28 Jan '26

I encountered a problem where multiple services had duplicate brain splits. There were two replication protocols that overlapped with each other. How can I delete the incorrect replication of the database generation ID? I don't want to do "reinitialize" as it would result in data loss. env ``` ubuntu16.04 CA freeipa4.3 fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com freeipa4.8 fs-hiido-kerveros-test08.hiido.host.yydevops.com ``` ssh fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com ``` root@fs-hiido-kerberos-21-117-149:/var/log/dirsrv/slapd-YYDEVOPS-COM# ldapsearch -LLL -x -H ldap://localhost:389 -D "cn=Directory Manager" -w xx -b "cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=mapping tree,cn=config" "(objectClass=nsds5ReplicationAgreement)" cn nsDS5ReplicaHost nsds5replicaLastUpdateStatus dn: cn=fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com-to-fs-hiido-kerver os-test08.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=m apping tree,cn=config cn: fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com-to-fs-hiido-kerveros- test08.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-kerveros-test08.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 402 Replication error acquiring replica: unknown error - Replica has different database generation ID, remote replica may nee d to be initialized dn: cn=meTofs-hiido-ipa-65-155.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyyde vops\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-ipa-65-155.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-ipa-65-155.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental upd ate succeeded dn: cn=meTofs-hiido-kerberos-ca-02.hiido.host.yydevops.com,cn=replica,cn=dc\3D yydevops\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-kerberos-ca-02.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-kerberos-ca-02.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental upd ate succeeded dn: cn=meToipa-65-189.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyydevops\2Cdc \3Dcom,cn=mapping tree,cn=config cn: meToipa-65-189.hiido.host.yydevops.com nsDS5ReplicaHost: ipa-65-189.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental upd ate succeeded root@fs-hiido-kerberos-21-117-149:/var/log/dirsrv/slapd-YYDEVOPS-COM# ``` ssh fs-hiido-kerveros-test08.hiido.host.yydevops.com ``` error log [28/Jan/2026:18:22:13.802652193 +0800] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=fs-hiido-kerveros-test08.hiido.host.yydevops.com-to-fs-hiido-kerberos-21…" (fs-hiido-kerberos-21-117-149:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. [28/Jan/2026:18:22:14.825827647 +0800] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=fs-hiido-kerveros-test08.hiido.host.yydevops.com-to-fs-hiido-ipa-65-155.…" (fs-hiido-ipa-65-155:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. root@fs-hiido-kerveros-test08:~# cat ref_149.ldif dn: cn=fs-hiido-kerveros-test08.hiido.host.yydevops.com-to-fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=mapping tree,cn=config changetype: modify add: nsds5BeginReplicaRefresh nsds5BeginReplicaRefresh: start ldapmodify -H ldap://localhost:389 -Y GSSAPI -f 149_reinit.ldif root@fs-hiido-kerveros-test08:/var/log/dirsrv/slapd-YYDEVOPS-COM# ldapsearch -LLL -x -H ldap://localhost:389 -D "cn=Directory Manager" -w ipaadmin4yycluster -b "cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=mapping tree,cn=config" "(objectClass=nsds5ReplicationAgreement)" cn nsDS5ReplicaHost nsds5replicaLastUpdateStatus dn: cn=fs-hiido-kerveros-test08.hiido.host.yydevops.com-to-fs-hiido-ipa-65-155 .hiido.host.yydevops.com,cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=mapping tr ee,cn=config cn: fs-hiido-kerveros-test08.hiido.host.yydevops.com-to-fs-hiido-ipa-65-155.hi ido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-ipa-65-155.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: Error (0) Replica acquired successfully: Increme ntal update succeeded dn: cn=fs-hiido-kerveros-test08.hiido.host.yydevops.com-to-fs-hiido-kerberos-2 1-117-149.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=m apping tree,cn=config cn: fs-hiido-kerveros-test08.hiido.host.yydevops.com-to-fs-hiido-kerberos-21-1 17-149.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: Error (0) Replica acquired successfully: Increme ntal update succeeded ``` ssh fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com ``` root@fs-hiido-kerberos-21-117-149:/var/log/dirsrv/slapd-YYDEVOPS-COM# ldapsearch -LLL -x -H ldap://localhost:389 -D "cn=Directory Manager" -w ipaadmin4yycluster -b "cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=mapping tree,cn=config" "(objectClass=nsds5ReplicationAgreement)" cn nsDS5ReplicaHost nsds5replicaLastUpdateStatus dn: cn=fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com-to-fs-hiido-kerver os-test08.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=m apping tree,cn=config cn: fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com-to-fs-hiido-kerveros- test08.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-kerveros-test08.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental upd ate succeeded dn: cn=meTofs-hiido-ipa-65-155.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyyde vops\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-ipa-65-155.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-ipa-65-155.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental upd ate succeeded dn: cn=meTofs-hiido-kerberos-ca-02.hiido.host.yydevops.com,cn=replica,cn=dc\3D yydevops\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-kerberos-ca-02.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-kerberos-ca-02.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 1 Can't acquire busy replica dn: cn=meToipa-65-189.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyydevops\2Cdc \3Dcom,cn=mapping tree,cn=config cn: meToipa-65-189.hiido.host.yydevops.com nsDS5ReplicaHost: ipa-65-189.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 402 Replication error acquiring replica: unknown error - Replica has different database generation ID, remote replica may nee d to be initialized dn: cn=meToipa-65-189.hiido.host.yydevops.com... changetype: modify add: nsds5BeginReplicaRefresh nsds5BeginReplicaRefresh: start ldapmodify -H ldap://localhost:389 -Y GSSAPI -f 189_reinit.ldif root@fs-hiido-kerberos-21-117-149:~# ldapsearch -LLL -x -H ldap://localhost:389 -D "cn=Directory Manager" -w ipaadmin4yycluster -b "cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=mapping tree,cn=config" "(objectClass=nsds5ReplicationAgreement)" cn nsDS5ReplicaHost nsds5replicaLastUpdateStatus dn: cn=fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com-to-fs-hiido-kerver os-test08.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyydevops\2Cdc\3Dcom,cn=m apping tree,cn=config cn: fs-hiido-kerberos-21-117-149.hiido.host.yydevops.com-to-fs-hiido-kerveros- test08.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-kerveros-test08.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 402 Replication error acquiring replica: unknown error - Replica has different database generation ID, remote replica may nee d to be initialized dn: cn=meTofs-hiido-ipa-65-155.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyyde vops\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-ipa-65-155.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-ipa-65-155.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental upd ate succeeded dn: cn=meTofs-hiido-kerberos-ca-02.hiido.host.yydevops.com,cn=replica,cn=dc\3D yydevops\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-kerberos-ca-02.hiido.host.yydevops.com nsDS5ReplicaHost: fs-hiido-kerberos-ca-02.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental upd ate succeeded dn: cn=meToipa-65-189.hiido.host.yydevops.com,cn=replica,cn=dc\3Dyydevops\2Cdc \3Dcom,cn=mapping tree,cn=config cn: meToipa-65-189.hiido.host.yydevops.com nsDS5ReplicaHost: ipa-65-189.hiido.host.yydevops.com nsds5replicaLastUpdateStatus: 0 Replica acquired successfully: Incremental upd ate succeeded ```

1 0

FOSDEM 2026 and FreeIPA/SSSD presence
by Alexander Bokovoy 26 Jan '26

26 Jan '26

Hi, this upcoming weekend the largest free software event in Europe will happen in Brussels, Belgium: https://fosdem.org/. FreeIPA, SSSD, and a lot of other free software projects will be present there. If you are at FOSDEM, make sure to meet your fellow free software developers. On Saturday, January 31st, we will run a demo stand for the first time: https://fosdem.org/2026/stands/ "Sovereign Identity for server, desktop, and a cloud Keycloak, FreeIPA, SSSD, OpenWallet (SAT)" The stand will be available from 10:00 to 19:00, at building K, level 1, group C (System Administration). At this stand you will have an opportunity to meet FreeIPA, SSSD, and Keycloak developers. We hope to demonstrate various integration scenarios, including latest desktop integration effort done together with GNOME folks. On Sunday, Identity and Access Management devroom will be run from 9:00 to 17:00 at room H.2214: https://fosdem.org/2026/schedule/track/identity-and-access-management/ If you aren't in Brussels, all talks will be streamed online and recordings will be published later as well. However, meeting in person is something that FOSDEM is the best for, together with waffles and a local beer. See you all there! -- / Alexander Bokovoy Sr. Principal Software Engineer Security / Identity Management Engineering Red Hat Limited, Finland

1 0

HTTP returns non-2xx status code
by Tania Hagan 26 Jan '26

26 Jan '26

Hi freeipa-users, We're currently using Freeipa version 4.11.0 on Rocky 9.4 with Apache/2.4.57 and every so often our HTTP fails with our monitoring returning non-2xx status code. Looking at the error log for httpd I see: [mpm_event:error] [pid 1800:tid 1800] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase ServerLimit. Researching this error, it appears to recommend adding to the httpd configuration https://forum.directadmin.com/threads/ah03490-scoreboard-is-full-note-at-ma…. Has anyone had to do this or can recommend a "freeipa" way to resolve this? (Reluctant to mess around with the httpd configuration as unsure on the effects of the client connections with freeipa) Many Thanks, Tania

3 6

[SSSD] Announcing SSSD 2.9.8
by Pavel Březina 21 Jan '26

21 Jan '26

# SSSD 2.9.8 The SSSD team is announcing the release of version 2.9.8 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.9.8 See the full release notes at: https://sssd.io/release-notes/sssd-2.9.8.html While we plan to maintain this branch providing critical bug fixes upstream, we don't commit to regular releases off this branch going forward. We recommend switching to the latest upstream release 2.12.0. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users # SSSD 2.9.8 Release Notes ## Highlights ### General information * After startup SSSD already creates a Kerberos configuration snippet typically in /var/lib/sss/pubconf/krb5.include.d/localauth_plugin if the AD or IPA providers are used. This enables SSSD's localauth plugin. Starting with this release the an2ln plugin is disabled in the configuration snippet as well. If this file or its content are included in the Kerberos configuration it will fix CVE-2025-11561. ### Configuration changes * An option `ipa_enable_dns_sites`, that never worked due to missing server side implementation, was removed. * The default value of session_provider option was changed to none (i.e. disabled) no matter what id_provider used. Previously session_provider was enabled by default for id_provider = ipa case. The primary tool it was intended to support, “Fleet Commander,” has become obsolete. * The option `ipa_subid_ranges_search_base` was deprecated in favor of `ldap_subid_ranges_search_base`.

1 0

Re: IPA users/groups are gone after a second reboot
by Sven Jansen 20 Jan '26

20 Jan '26

Hi, I see the same problem on my IPA installations for around one or two weeks now. All affected machines run FreeIPA 4.9.13-20. * one machine is a RHEL 8.10 standalone deployment * two machines are AlmaLinux 8.10 sync between each other * All instances have the full capability, DNS, Certificate Authority and acme. These installations are not related and in different companys. On the first RHEL machine, users are listed, groups are not, some other object types are missing, you can find objects by searching for the name, same with ipa find-user. Fresh created users/group/hosts work fine and show up in Web interface and ipa find-user. On the second pair (running AlmaLinux), its a bit different, no users, groups, hosts, sudo rules etc. are shown, only fresh created objects show up by using the Web interface or using ipa command. DNS is a bit different, on IPA1, all DNS zones are visible, on IPA2, no zones are visible, except i create a new zone. Luckly i still can see all zones on IPA1. Searching for DNS zones on IPA2 does not work, but i can reach the zone by changing the url to “/ipa/ui/#/e/dnszone/records/mydomain.com” on IPA2, so they are there and accessible. I tried to edit existing objects to see if they pop up, but no luck. I ran ipa-server-upgrade to see if some migration is missing, but it finish without issue and the problem persist. No issues with DNS lookups, getting certs or provide authentication, just searching/showing objects is broken I have no clue how to fix that, i can see no “useful” information in my slapd logs or i dont know what to lock for.

4 7

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2026