FreeIPA-users April 2026

freeipa-users@lists.fedorahosted.org

11 participants
14 discussions

Best way to upgrade FreeIpa version and OS
by Youssef CHTOUROU 27 Jul '26

27 Jul '26

Hello I've 3 FreeIpa Servers (version =4.6.8) runned on Centos 7. I'am looking for upgrade these servers like that : Centos 7 to Rocky 8 FreeIpa server to most recent version possible I would like to see your advice : what is the best / secure way to do this upgrade ? Thanks a lot

2 1

configure ipa-healthcheck?
by lejeczek 08 May '26

08 May '26

I see there is a config file and I searched, but failed to find an info on how to, ideally permanently, tell ipa-healthcheck what is the threshold for filesystem - do you now? thanks, L.

4 3

Custom profil for Sub CA and root CA
by Olivier G 01 May '26

01 May '26

Hi, I'm new to FreeIPA and I would like to create a sub CA with a custom profil. It seems to be impossible from ipa commands. Is there any others possibilities ? Same question for the root CA : is there any possibilities to create a root CA within FreeIPA with a custom profil ? Thanks for reading. Olivier

4 5

Does FreeIPA support SIDHistory
by Yuriy Halytskyy 30 Apr '26

30 Apr '26

Our FreeIPA instance is configured to trust an AD domain that is going to change their user SIDs. Does FreeIPA support SIDHistory for access control? Cheers, Yuriy

1 0

[SSSD] Watch Github for next releases
by Pavel Březina 29 Apr '26

29 Apr '26

Please note that the sssd-2.13.0 was the last release that was announced on sssd-devel, sssd-users and freeipa-users mailing lists. Please, setup GitHub notifications [1] on SSSD/sssd repository [2] to get notified about the next releases. Thank you, Pavel from SSSD team. [1] https://docs.github.com/en/subscriptions-and-notifications/get-started/conf… [2] https://github.com/SSSD/sssd

1 0

[SSSD] Announcing SSSD 2.13.0
by Pavel Březina 29 Apr '26

29 Apr '26

# SSSD 2.13.0 The SSSD team is announcing the release of version 2.13.0 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.13.0 See the full release notes at: https://sssd.io/release-notes/sssd-2.13.0.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users # SSSD 2.13.0 Release Notes ## Highlights ### General information - Security fix for CVE-2026-6245: out-of-bounds read in PAM passkey responder - During the processing of the `pam_sss_gss` request SSSD will read the SID from the PAC of the Kerberos ticket and might add authentication indicators based on the value of the new option `pam_gssapi_indicators_apply`. The primary use case is to handle SIDs added by Active Directory's Authentication Mechanism Assurance (AMA). - Active Directory's Foreign Security Principals (FSP) are now properly detected and ignored when reading nested group members. The `ldap_ignore_unreadable_references` option is only needed to ignore member objects which are really not accessible. - A number of cache performance optimizations for large deployments. ### New features - Tokens acquired from the IdP are now stored in the domain cache, and are automatically refreshed if the new option `idp_auto_refresh` is enabled. - `idp_type` option allows `entra_idp` url to be specified if user is using a different Microsoft Entra endpoint. - KDE Plasma Login Manager support. ### Configuration changes - New option `avoid_by_id_lookups` to tell the SSSD responders to use a lookup by name instead of by id where possible - New options to customize the OAuth2 prompting behavior: `interactive` and `interactive_prompt`. ### Packaging changes - New `./configure` option `--enable-sensitive-logs` to enable logging of sensitive data (like, for example, IdP tokens). Recommended for debug builds only.

1 0

Authenticate users with yubikeys without importing the certificate in IPA does not work.
by Theodor Vallier 23 Apr '26

23 Apr '26

Hello, I'm trying to allow authentication using Yubikeys on clients without importing user's certificates in idM. I use an external PKI that signs everything, so I have the root CA and one sub CA named piv that signs users' csr (that are stored in yubikeys). On the server, the output of ipa-advise config-server-for-smart-card-auth is executed and the output of ipa-advise config-client-for-smart-card-auth is also executed on the client. I added both the certificate mapping rule and the certificate mapping data (Issuer and subject) according to red hat documentation. Steps to Reproduce: In an internet forbidden environment, using at least three VMs on RHEL9. One for IPA, one as a workstation and one that will be the DHCP, DNS and NTP server. Once the DNS and DHCP are configured, I generated a root CA and two sub CAs, one for signing users csr (piv) and one for signing everything else (like ipa). Once ipa is installed with an external ca, I executed the output of ipa-advise config-server-for-smart-card-auth to load and configure ipa for smartcard. Then I added the Certificate Identity Mapping Rule: Mapping rule: (ipacertmapdata=X509:<I\>{issuer\_dn!nss\_x500}<S>{subject_dn!nss_x500}) Matching rule: <ISSUER>CN=piv,C=FR Once the client is registered in ipa, I executed the output of ipa-advise config-client-for-smart-card-auth to load and configure the client for smartcard. Then, I registered a new user, with pkinit enable and I created a Certificate mapping data for him with the good Subject and the same Issuer as the Certificate Identity Mapping Rule. Finally, I set up the yubikey for the corresponding user using the PKI and signed his certificate with the piv CA. Actual behavior: If the user certificate is not present in ipa, I'm prompted to enter the PIN CODE (the Yubikey is recognized and the user is automatically selected), but then I have the error "Sorry, smart card authentication didn't work, please try again". On ipa server, if I use the command ipa certmap-match <user-certificate>, no users are found. Furthermore, in sssd I can see that the server is trying to find a user with the certificate stored on the yubikey instead of trying to check if the certificate is valid and signed by the piv sub CA. Expected behavior: I would expect to be logged in. Version/Release/Distribution: ipa-server-4.10.1-9.el9_2.x86_64 ipa-client-4.10.1-9.el9_2.x86_64 389-ds-base-2.2.4-5.el9_2.x86_64 krb5-server-1.20.1-9.el9_2.x86_64 sssd-2.8.2-3.el9_2.x86_64 Additional info: I can provide more logs if necessary but don't know which ones you could want. Thanks Whidix

3 4

LDAP searches failing, preventing updating SSL Certificate
by Chris Candreva 23 Apr '26

23 Apr '26

I'm trying to help out with an IPA setup, and I'm sure if or how two problems are related. The first thing they noticed was that no users or domains show up in the web list, but you can go directly to one if you know the name. Then other services that authenticate via LDAP started complaining that the SSL certificate was expired. Evidently when they updated, the certificate for the web site updated, but not LDAP. In order for ipa-certupdate to run at all, I set httpd on all three replicas to the prvious certificate (expired in Feb), and set the clock to a date in January where both certificates were valid. ipa-certupdate procedes, until it hits an error that it can't find any servers with the 'CA server' role. Checking 'ipa server-show' for each IPA server shows the 'CA server' role, but searching by roles yields no results. At this point I'm stuck, my searching has been fruitless, and I could use some help . Thank you in advance ! [root@ipa alias]# ipa server-show ipa.westnet.com|grep roles Enabled server roles: CA server, DNS server, IPA master [root@ipa alias]# ipa server-show ipa2.westnet.com|grep roles Enabled server roles: CA server, DNS server, IPA master [root@ipa alias]# ipa server-show ipa3.westnet.com|grep roles Enabled server roles: CA server, DNS server, IPA master [root@ipa alias]# ipa server-find --servrole "CA server" ipa: ERROR: no matching entry found [root@ipa alias]# ipa server-find --servrole "DNS server" ipa: ERROR: no matching entry found [root@ipa alias]# ipa server-find --servrole "IPA server" --------------------- 0 IPA servers matched --------------------- ---------------------------- Number of entries returned 0 ---------------------------- [root@ipa alias]# ipa server-find --servrole "IPA master" ipa: ERROR: no matching entry found [root@ipa alias]# ipa server-find --servrole "Jedi Knight" --------------------- 0 IPA servers matched --------------------- ---------------------------- Number of entries returned 0 ---------------------------- -- --- ======================================================================== Chris Candreva -- chris(a)westnet.com -- http://www.westnet.com/~chris

2 6

Changing directory manager password?
by Aram Akhavan 22 Apr '26

22 Apr '26

Hi everyone. I want to change the directory manager password. Is this document up to date? https://www.freeipa.org/page/Howto/Change_Directory_Manager_Password It's not linked from anywhere else that I can see, and the ldappasswd command is wrong (presumably due to a newer version used in AlmaLinux 10). I also have a couple of questions (assuming this document is accurate): * There is no internaldb entry in /etc/pki/pki-tomcat/password.conf. Am I supposed to put the directory manager password in there plain text? * Is the intention for the PKI admin in the directory (uid=admin,ou=people,o=ipaca) to have the same password as the directory manager? Isn't that a bad idea for security? Thanks!

2 2

Re: Fresh install of 4.12.2 with intermittent Login problems (fwd)
by Freeipa Users 20 Apr '26

20 Apr '26

The issue of no access to accounts with password+OTP enforced was seemingly caused by SELinux on a 10.1 Redhat systen. We found this warning message: SELinux is preventing /usr/sbin/krb5kdc from connect to access on the unix_stream_socket /run/krb5kdc/DEFAULT.socket. The usual procedure to "allow this access for now" was followed and the accounts became accessible instantly. The issue did not come up again since then. Could be there is another issue when entering the password via copy+paste. Which we did for the tests. They had to be typed in order to work. Smells like caused by bracketed paste mode for readline, so we switched that off in /etc/inputrc. In both cases we did not attempt to reproduce the issue, we are simply glad it works. We appreciate your support and like the good work behind FreeIPA. -W.

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users April 2026