FreeIPA-users May 2026

freeipa-users@lists.fedorahosted.org

20 participants
16 discussions

Best way to upgrade FreeIpa version and OS
by Youssef CHTOUROU 26 Jul '26

26 Jul '26

Hello I've 3 FreeIpa Servers (version =4.6.8) runned on Centos 7. I'am looking for upgrade these servers like that : Centos 7 to Rocky 8 FreeIpa server to most recent version possible I would like to see your advice : what is the best / secure way to do this upgrade ? Thanks a lot

2 1

ipa-replica-install failing at initial replication
by Tania Hagan 22 Jun '26

22 Jun '26

Hi FreeIPA users, I'm attempting to install a replica on Rocky 10 from an existing replica on Rocky 9. On the replica I see: sudo grep -iE "critical|error|exception" /var/log/ipareplica-install.log 2026-05-14T15:36:52Z DEBUG Entry found [LDAPEntry(ipapython.dn.DN('cn=meToipa-lon-3.thomac.net,cn=replica,cn=dc\=thomac\,dc\=net,cn=mapping tree,cn=config'), {'objectClass': [b'nsds5replicationagreement', b'top'], 'cn': [b'meToipa-lon-3.thomac.net'], 'nsDS5ReplicaHost': [b'ipa-lon-3.thomac.net'], 'nsDS5ReplicaPort': [b'389'], 'nsds5replicaTimeout': [b'120'], 'nsDS5ReplicaRoot': [b'dc=thomac,dc=net'], 'description': [b'me to ipa-lon-3.thomac.net'], 'nsDS5ReplicatedAttributeList': [b'(objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime'], 'nsDS5ReplicaTransportInfo': [b'LDAP'], 'nsDS5ReplicaBindMethod': [b'SASL/GSSAPI'], 'nsds5ReplicaStripAttrs': [b'modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp'], 'nsDS5ReplicatedAttributeListTotal': [b'(objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime'], 'nsds5replicareapactive': [b'0'], 'nsds5replicaLastUpdateStart': [b'19700101000000Z'], 'nsds5replicaLastUpdateEnd': [b'19700101000000Z'], 'nsds5replicaChangesSentSinceStartup': [b''], 'nsds5replicaLastUpdateStatus': [b'Error (49) Problem connecting to replica - LDAP error: Invalid credentials (connection error)'], 'nsds5replicaLastUpdateStatusJSON': [b'{"state": "red", "ldap_rc": "49", "ldap_rc_text": "Invalid credentials", "repl_rc": "16", "repl_rc_text": "connection error", "date": "2026-05-14T15:36:52Z", "message": "Error (49) Problem connecting to replica - LDAP error: Invalid credentials (connection error)"}'], 'nsds5replicaUpdateInProgress': [b'FALSE'], 'nsds5replicaLastInitStart': [b'19700101000000Z'], 'nsds5replicaLastInitEnd': [b'19700101000000Z']})] 2026-05-14T15:36:52Z DEBUG Entry found [LDAPEntry(ipapython.dn.DN('cn=meToipa-lon-1.thomac.net,cn=replica,cn=dc\=thomac\,dc\=net,cn=mapping tree,cn=config'), {'objectClass': [b'nsds5replicationagreement', b'top'], 'cn': [b'meToipa-lon-1.thomac.net'], 'nsDS5ReplicaHost': [b'ipa-lon-1.thomac.net'], 'nsDS5ReplicaPort': [b'389'], 'nsds5replicaTimeout': [b'120'], 'nsDS5ReplicaRoot': [b'dc=thomac,dc=net'], 'description': [b'me to ipa-lon-1.thomac.net'], 'nsDS5ReplicatedAttributeList': [b'(objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime'], 'nsDS5ReplicaTransportInfo': [b'LDAP'], 'nsDS5ReplicaBindMethod': [b'SASL/GSSAPI'], 'nsds5ReplicaStripAttrs': [b'modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp'], 'nsDS5ReplicatedAttributeListTotal': [b'(objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime'], 'nsds5replicareapactive': [b'0'], 'nsds5replicaLastUpdateStart': [b'19700101000000Z'], 'nsds5replicaLastUpdateEnd': [b'19700101000000Z'], 'nsds5replicaChangesSentSinceStartup': [b''], 'nsds5replicaLastUpdateStatus': [b'Error (0) No replication sessions started since server startup'], 'nsds5replicaLastUpdateStatusJSON': [b'{"state": "green", "ldap_rc": "0", "ldap_rc_text": "success", "repl_rc": "0", "repl_rc_text": "replica acquired", "date": "2026-05-14T15:36:52Z", "message": "Error (0) No replication sessions started since server startup"}'], 'nsds5replicaUpdateInProgress': [b'FALSE'], 'nsds5replicaLastInitStart': [b'19700101000000Z'], 'nsds5replicaLastInitEnd': [b'19700101000000Z']})] raise RuntimeError("Failed to start replication") RuntimeError: Failed to start replication 2026-05-14T15:38:58Z DEBUG [error] RuntimeError: Failed to start replication File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458, in _handle_exception File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 526, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458, in _handle_exception File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 523, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458, in _handle_exception raise RuntimeError("Failed to start replication") 2026-05-14T15:38:58Z DEBUG The ipa-replica-install command failed, exception: RuntimeError: Failed to start replication 2026-05-14T15:38:58Z ERROR Failed to start replication 2026-05-14T15:38:58Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information and on the existing replica I see: [14/May/2026:15:37:10.784513370 +0000] - WARN - content-sync-plugin - sync_update_persist_betxn_pre_op - DB retried operation targets "changenumber=68535600,cn=changelog" (op=0x7f62b0043800 idx_pl=1) => op not changed in PL [14/May/2026:15:38:50.526377911 +0000] - WARN - content-sync-plugin - sync_update_persist_betxn_pre_op - DB retried operation targets "changenumber=68535707,cn=changelog" (op=0x7f638133b800 idx_pl=1) => op not changed in PL [14/May/2026:15:38:50.590699199 +0000] - WARN - NSMMReplicationPlugin - replica_generate_next_csn - opcsn=6a05ee16000500340000 <= basecsn=6a05ee17000600300000, adjusted opcsn=6a05ee17000700340000 [14/May/2026:15:38:57.511706451 +0000] - ERR - NSMMReplicationPlugin - perform_operation - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): Failed to send extended operation: LDAP error -1 (Can't contact LDAP server) [14/May/2026:15:38:57.517218118 +0000] - ERR - NSMMReplicationPlugin - repl5_tot_log_operation_failure - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): Received error -1 (Can't contact LDAP server): for total update operation [14/May/2026:15:38:57.520123870 +0000] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): Unable to send endReplication extended operation (Can't contact LDAP server) [14/May/2026:15:38:57.522323162 +0000] - ERR - NSMMReplicationPlugin - repl5_tot_run - Total update failed for replica "agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389)", error (-11) [14/May/2026:15:38:57.524104058 +0000] - ERR - NSMMReplicationPlugin - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): Total update flow control triggered 59 times You may increase nsds5ReplicaFlowControlPause and/or decrease nsds5ReplicaFlowControlWindow in the replica agreement configuration [14/May/2026:15:38:57.816155969 +0000] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): Replication bind with GSSAPI auth resumed [14/May/2026:15:38:58.098378634 +0000] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. [14/May/2026:15:39:00.874788979 +0000] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. I remove the replica by running: On the existing replica: ipa-replica-manage del ipa-lon-3.thomac.net --force --cleanup ipa server-del ipa-lon-3.thomac.net ipa host-del ipa-lon-3.thomac.net dsconf -D "cn=Directory Manager" ldaps://localhost repl-agmt delete --suffix "dc=thomac,dc=net" meToipa-lon-3.thomac.net and find no replica agreements with ipa topologysegment-find ca, and ipa topologysegment-find domain On the new replica: ipa-server-install --uninstall -U and kdestroy -A When I attempt a reinstall I run: ipa-client-install --server ipa-lon-1.thomac.net --domain=thomac.net Make sure to add A record with PTR kinit admin ipa hostgroup-add-member ipaservers --hosts ipa-lon-3.thomac.net ipa-replica-install --principal admin -v and it still fails. The vms are on the same network, subnet, and have the same mtu ipa-healthcheck returns [] the clock is the same dig and host is good from both machines I've also tried the command to a different replica and it still fails I was able to upgrade my poc freeipa from rocky 9 and rocky 10 fine using both manual commands and ansible playbook, but my production freeipa replicas are failing. Any ideas of anything else I can try? Many Thanks, Tania

3 7

New users can't log in with expired passwords
by Aram Akhavan 04 Jun '26

04 Jun '26

As documented in https://www.freeipa.org/page/New_Passwords_Expired I can see that when an admin creates a new user or resets a password, it is immediately expired. Users can log in and immediately change it. However, I'm unable to get that to work whether from the web gui, ssh, or anything else. I've created a test user with admin privileges; it's password is expired. I try logging into the web UI, and it says "The password or username you entered is incorrect", nothing about an expired password (I know the password is right!). The response header of the GUI POST request has X-IPA-Rejection-Reason: invalid-password, not X-IPA-Rejection-Reason: password-expired as is suggested here: https://github.com/freeipa/freeipa-webui/discussions/29 If I log in to the ipa server with my own user account (which somehow, I managed to create and use without issue...), and try to do an `su test`, I see krb5_child complain: Password has expired. It seems impossible to log in with an expired password. Yet my own user account was created, so presumably I changed some setting but I can't for the life of me figure out what I changed. Thanks for the help!

3 5

FreeIPA replica install fails after initial replication: one-level search under cn=masters returns 0 until userRoot reindex
by 박성호 27 May '26

27 May '26

Hi FreeIPA users, I am investigating a reproducible FreeIPA/IdM replica installation failure. Summary: After initial replication succeeds during ipa-replica-install, local LDAP subtree searches under cn=masters work, but one-level searches under the same DN return zero entries. This causes ipa server-find --servrole="IPA master", ipa server-role-find --include-master, and dns_update_system_records during replica installation to fail with: no matching entry found A full userRoot reindex immediately fixes the issue. Environment: - Existing master: RHEL 8.10, FreeIPA 4.9.x - New replica test 1: RHEL 8.10, FreeIPA 4.9.x - New replica test 2: RHEL 9.x, FreeIPA 4.13.x - Domain: idm.example.com - Realm: IDM.EXAMPLE.COM The same behavior is reproduced on both RHEL8 and RHEL9 replicas. Failure path from ipareplica-install.log: ipa-replica-install -> dns_update_system_records() -> server_find(servrole='IPA master') -> server_role_find(role_servrole='IPA master', status='enabled', include_master=True) -> servroles._fill_in_absent_masters() -> ldap2.get_entries() -> EmptyResult: no matching entry found Before reindex, on the new replica: ldapsearch -H ldapi://%2Frun%2Fslapd-IDM-EXAMPLE-COM.socket -Y GSSAPI -LLL \ -b "cn=masters,cn=ipa,cn=etc,dc=idm,dc=example,dc=com" \ -s one "(objectClass=*)" dn cn objectClass returns no entries. But subtree search works: ldapsearch -H ldapi://%2Frun%2Fslapd-IDM-EXAMPLE-COM.socket -Y GSSAPI -LLL \ -b "cn=masters,cn=ipa,cn=etc,dc=idm,dc=example,dc=com" \ -s sub "(objectClass=ipaConfigObject)" dn cn objectClass returns the expected master and service entries. After running: dsconf IDM-EXAMPLE-COM backend index reindex --wait userRoot the one-level search works, and ipa server-find / ipa dns-update-system-records work. Things already checked: - This does not appear to be specific to a RHEL8 or RHEL9 replica target. - The replicated data appears to exist locally; the issue seems specific to one-level search/index behavior under cn=masters. - A full userRoot reindex immediately makes the same one-level search and FreeIPA commands work. Question: Is this a known 389-ds / FreeIPA replica initialization issue where the local parent/one-level search index is incomplete immediately after total init? Is there a supported way to force or verify index consistency before ipa-replica-install reaches dns_update_system_records? Please let me know if this should be reported to 389-ds instead of FreeIPA. Thanks. [고객의소리열기]<https://cppm.singlex.com/public/painpointDirects/C998?mediaSource=EMAIL> ________________________________ 상기 메시지와 첨부화일 내에는 비밀정보가 포함되어 있을 수 있으며, 지정된 수신자에 한하여 조회 및 사용될 수 있습니다. 만약 송신자의 실수로 인하여 상기 메시지를 수신하였다면, 송신자에게 메시지를 반송해 주시고, 원본 메시지와 모든 사본을 폐기해 주시기 바랍니다. 상기 메시지의 전체 또는 일부에 대해 무단 열람, 사용, 공개, 배포하는 것은 금지되어 있습니다.(주)LG CNS. This message and its attachments may contain confidential information, and they are intended to be viewed or used by only the individuals specified in the message. If you have received this message in an error from the sender, please contact the sender immediately to notify the error and delete all of the message and its copies. It is prohibited to view, use, make public and/or distribute part or whole of this message without written permission.

3 4

Are sn and givenName (reasonably) guaranteed to exist for all users?
by Aram Akhavan 26 May '26

26 May '26

Hi, I'm working on a small update to authelia (web authn/oidc provider that can use free-ipa as a backend) and was wondering if we can depend on sn and givenName to exist for all users back through a reasonable history of freeipa versions? I want to map those to OIDC claims, but it will cause problems if they don't exist. Thanks, Aram

3 3

RHEL 10 ipa-replica-install failure: MDB_BAD_VALSIZE during initial replication
by Sam Morris 26 May '26

26 May '26

I'm working on replacing my RHEL 9 ipa servers with RHEL 10. I'm having trouble running ipa-replica-install on the RHEL 10 machine. ipa6 is the existing replica, running 389-ds-base-2.7.0-12.el9_7.x86_64 ipa7 will be the new replica, running 389-ds-base-3.1.3-7.el10_1.x86_64 The initial problem is as described in <https://access.redhat.com/solutions/374063>; ipa-replica-install fails on ipa7 with: # ipa-replica-install --setup-dns --auto-forwarder --setup-ca --setup-kra [...] [25/39]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 6 seconds elapsed [ldap://ipa6.example.com:389] reports: Update failed! Status: [Error (-2) connection error: Unknown connection error (-2) - Total update aborted] [error] RuntimeError: Failed to start replication As I understand it, ipa6 is reporting that it's unable to push replication data to ipa7. ipa7's dirsrv error log has: [14/May/2026:08:34:01.024056108 +0000] - NOTICE - NSMMReplicationPlugin - multisupplier_be_state_change - Replica dc=example,dc=com is going offline; disabling replication [14/May/2026:08:34:06.016144780 +0000] - ERR - sasl_io_start_packet - SASL encrypted packet length exceeds maximum allowed limit (length=2097156, limit=2097152). Change the nsslapd-maxsasliosize attribute in cn=config to increase limit. [14/May/2026:08:34:06.020122827 +0000] - ERR - factory_destructor - ERROR bulk import abandoned: conn=6 was closed [14/May/2026:08:34:06.039293730 +0000] - INFO - dbmdb_import_monitor_threads - import userRoot: Import writer thread usage: run: 25.65% read: 38.59% write: 35.50% pause: 0.15% txnbegin: 0.00% txncommit: 0.11% [14/May/2026:08:34:06.187327861 +0000] - INFO - dbmdb_import_monitor_threads - import userRoot: Workers finished; cleaning up... [14/May/2026:08:34:06.190813134 +0000] - INFO - dbmdb_import_monitor_threads - import userRoot: Workers cleaned up. [14/May/2026:08:34:06.192987116 +0000] - ERR - dbmdb_import_run_pass - import userRoot: Thread monitoring returned: -23 [14/May/2026:08:34:06.194912877 +0000] - ERR - dbmdb_public_dbmdb_import_main - import userRoot: Aborting all Import threads... [14/May/2026:08:34:06.196678126 +0000] - ERR - dbmdb_public_dbmdb_import_main - import userRoot: Import threads aborted. [14/May/2026:08:34:06.198682179 +0000] - INFO - dbmdb_public_dbmdb_import_main - import userRoot: Closing files... [14/May/2026:08:34:06.206359538 +0000] - ERR - dbmdb_public_dbmdb_import_main - import userRoot: Import failed. [14/May/2026:08:34:06.208655028 +0000] - INFO - dbmdb_task_finish - userRoot: Finished importing. Exit code is -23 [14/May/2026:08:34:06.624898860 +0000] - ERR - process_bulk_import_op - NULL target sdn So as advised in the knowledge base article, I cleaned up the failing replication agreement on ipa6, reinstalled ipa7 and tried again using a custom dirsrv config file that inreases nsslapd-maxsasliosize nd nsslapd-sasl-max-buffer-size to 5000000. I got the same failure, but with larger numbers: [14/May/2026:09:28:48.090911293 +0000] - ERR - sasl_io_start_packet - SASL encrypted packet length exceeds maximum allowed limit (length=5000004, limit=5000000). Change the nsslapd-maxsasliosize attribute in cn=config to increase limit. So I tried again, this time increasing both nsslapd-maxsasliosize and nsslapd-sasl-max-buffer-size to 8000000. This time ipa-replica-install didn't fail. Instead, the initial replication never completed: # ipa-replica-install --setup-dns --auto-forwarder --setup-ca --setup-kra --dirsrv-config-file=custom.ldif [...] [28/42]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 2736 seconds elapsed^C [error] KeyboardInterrupt: The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information The last lines in the error log are: [14/May/2026:09:39:27.252987013 +0000] - NOTICE - NSMMReplicationPlugin - multisupplier_be_state_change - Replica dc=example,dc=com is going offline; disabling replication [14/May/2026:09:39:33.330868063 +0000] - ERR - dbmdb_import_writer - Failed to write in the database. Error is 0xffff87c3: MDB_BAD_VALSIZE: Unsupported size of key/DB name/data, or wrong DUPFIXED size. [14/May/2026:09:39:33.436983183 +0000] - ERR - dbmdb_import_monitor_threads - import userRoot: thread writer aborted ==> Aborting bulk import. [14/May/2026:09:39:33.442402509 +0000] - ERR - process_bulk_import_op - Failed; error = -1 [14/May/2026:09:39:33.445013557 +0000] - ERR - factory_destructor - ERROR bulk import abandoned: conn=6 was closed [14/May/2026:09:39:33.541001450 +0000] - INFO - dbmdb_import_monitor_threads - import userRoot: Workers finished; cleaning up... [14/May/2026:09:39:33.544698620 +0000] - INFO - dbmdb_import_monitor_threads - import userRoot: Workers cleaned up. [14/May/2026:09:39:33.546954292 +0000] - ERR - dbmdb_import_run_pass - import userRoot: Thread monitoring returned: -23 [14/May/2026:09:39:33.548828730 +0000] - ERR - dbmdb_public_dbmdb_import_main - import userRoot: Aborting all Import threads... [14/May/2026:09:39:33.550942484 +0000] - ERR - dbmdb_public_dbmdb_import_main - import userRoot: Import threads aborted. [14/May/2026:09:39:33.553024072 +0000] - INFO - dbmdb_public_dbmdb_import_main - import userRoot: Closing files... [14/May/2026:09:39:33.557336393 +0000] - ERR - dbmdb_public_dbmdb_import_main - import userRoot: Import failed. [14/May/2026:09:39:33.559553914 +0000] - INFO - dbmdb_task_finish - userRoot: Finished importing. Exit code is -23 At this point the dirsrv process is still running but does not respond to any connections: # timeout 5 ldapsearch -Y EXTERNAL -H ldapi://%2frun%2fslapd-EXAMPLE-COM.socket -s base -b cn=config; echo $? SASL/EXTERNAL authentication started 124 ... nor does it respond to SIGTERM, I have to send SIGKILL to kill it. Summing up: 1. Something in my directory causes LMDB to fail with this error. But I don't know how do debug this further. 2. I think dirsrv hanging after this error is a bug that I can file separately once I've got past the MDB_BAD_VALSIZE error. 3. My database isn't all that large; a dozen users, several dozen hosts and serviecs. I wonder if it's worth increasing the defaults values for nsslapd-maxsasliosize and nsslapd-sasl-max-buffer-size? Assuming the place to request this would be with 389-ds-base I can do that as well. I've done some very preliminary investigation of my directory to maybe see where the problem might be. Taking the LMDB error at face value, and looking at the sizes of the files in the userRoot backend: root@ipa6:~# ls -1sh /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/* --sort=s -r | tail 120K /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/krbPrincipalName.db 128K /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/nsuniqueid.db 168K /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/entryusn.db 360K /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/cn.db 368K /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/memberOf.db 616K /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/member.db 4.1M /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/entryrdn.db 15M /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/id2entry.db 16M /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/userCertificate.db 39M /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/replication_changelog.db ... I've got a couple of ideas: * Maybe I've got too many userCertificate attributes, or one or more of them are too large? * One of my users had a 23 KiB jpegPhoto attribute which I have removed; however maybe it's still in the replication changelog and could therefore continue to cause problems? * It actually looks like <https://redhat.atlassian.net/browse/RHEL-133085> is this issue, in which case I should just wait for RHEL 10.2. As always any advice is appreciated! -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9

2 2

Odd things with ipa-healthcheck
by Ian Kumlien 25 May '26

25 May '26

Hi, I worked around the migration from bdb to lmdb since there was issues that later was patched. But now i'm encountering this: [ { "source": "ipahealthcheck.ds.backends", "check": "BackendsCheck", "result": "CRITICAL", "uuid": "6bd31d54-3fc0-498e-930d-460cae949218", "when": "20260520124304Z", "duration": "0.063039", "kw": { "exception": "[Errno 2] No such file or directory: '/dev/shm/slapd-XERCES-LAN'", "traceback": "Traceback (most recent call last):\n File \"/usr/lib/python3.14/site-packages/ipahealthcheck/core/core.py\", line 61, in run_plugin\n for result in plugin.check():\n ~~~~~~~~~~~~^^\n File \"/usr/lib/python3.14/site-packages/ipahealthcheck/core/plugin.py\", line 18, in wrapper\n for result in f(*args, **kwds):\n ~^^^^^^^^^^^^^^^\n File \"/usr/lib/python3.14/site-packages/ipahealthcheck/ds/plugin.py\", line 108, in check\n results = self.doCheck(self.check_class, self.many)\n File \"/usr/lib/python3.14/site-packages/ipahealthcheck/ds/plugin.py\", line 91, in doCheck\n results += result\n File \"/usr/lib/python3.14/site-packages/lib389/_mapped_object_lint.py\", line 126, in lint\n yield from f()\n File \"/usr/lib/python3.14/site-packages/lib389/backend.py\", line 556, in _lint_backend_implementation_cleanup_needed\n db_files.extend(os.listdir(self._instance.ds_paths.db_home_dir))\n ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nFileNotFoundError: [Errno 2] No such file or directory: '/dev/shm/slapd-XERCES-LAN'\n" } } ] Which didn't happen on 6 other machines i have installed... The only clue i can find is that my /etc/dirsrv/slapd-XERCES-LAN/dse.ldif is different There is a whole new section, the only section that mentions shm which is dn: cn=config,cn=ldbm database,cn=plugins,cn=config cn: config modifiersName: cn=Directory Manager modifyTimestamp: 20251103151530Z nsslapd-db-home-directory: /dev/shm/slapd-EGL-LAN nsslapd-systemidlistscanlimit: 5000 objectClass: top objectClass: extensibleObject numSubordinates: 3 nsslapd-lookthroughlimit: 100000 nsslapd-mode: 600 nsslapd-idlistscanlimit: 2147483646 nsslapd-directory: /var/lib/dirsrv/slapd-EGL-LAN/db nsslapd-import-cachesize: 16777216 nsslapd-idl-switch: new nsslapd-search-bypass-filter-test: on nsslapd-search-use-vlv-index: on nsslapd-exclude-from-export: entrydn entryid dncomp parentid numSubordinates t ombstonenumsubordinates entryusn nsslapd-serial-lock: on nsslapd-pagedlookthroughlimit: 0 nsslapd-pagedidlistscanlimit: 0 nsslapd-rangelookthroughlimit: 5000 nsslapd-backend-opt-level: 1 nsslapd-backend-implement: mdb nsslapd-dynamic-lists-enabled: off nsslapd-dynamic-lists-attr: member nsslapd-dynamic-lists-oc: groupOfUrls nsslapd-dynamic-lists-url-attr: memberURL So, is there a way to generate/fix dse.lfdif that is not just me hacking it?

2 7

pki-tomcatd cannot start
by Giulio Casella 14 May '26

14 May '26

Hello everyone, on two out of three ipa server of my setup pki-tomcatd refuse to start, giving: SEVERE: LdapBoundConnFactory: Unable to connect to LDAP server: Authentication failed After some quick research I tried to verify tomcat internal password: grep internal /var/lib/pki/pki-tomcat/conf/password.conf | cut -d= -f2 > /tmp/pwdfile.txt The password seems to be ok, but when I try to list keys I get: certutil -K -d /etc/pki/pki-tomcat/alias -f /tmp/pwdfile.txt -n 'subsystemCert cert-pki-ca' certutil: Checking token "NSS Certificate DB" in slot "NSS User Private Key and Certificate Services" certutil: problem listing keys: SEC_ERROR_INVALID_ALGORITHM: security library: invalid algorithm. (no SEC_ERROR_BAD_PASSWORD message, but SEC_ERROR_INVALID_ALGORITHM) Any ideas? My setup is based on rhel 9.7, fully updated (ipa-server-4.12.2-22.el9_7.4) TIA, Giulio

3 3

freeipa4.3 The 389ds service has crashed due to a pthread_mutex_lock.
by liang fei 13 May '26

13 May '26

The 389ds service has crashed due to a pthread_mutex_lock. Environment: Ubuntu 16.04, FreeIPA 4.3, 389-Directory/1.3.4.9 B2016.109.158 Trigger condition: When Ambari operation concurrently adds five nodes, a new Hadoop keytab file will be added. The 389ds service with a large number of krb clients for authentication and adding service keytab to 389ds Replication will deadlock, while the 389ds service without krb client login is normal. Therefore, this is a pthread_mutex_lock issue of (krb client -> search 389ds) + (add krb service -> 389ds data replica). I understand that Berkeley Database (bdb) has many problems, according to this document: https://www.port389.org/docs/389ds/howto/howto-use-lmdb.html. But I don't understand why the freeipa 4.3 version is so fragile? My current environment is reproducible. Only when adding krb service keytab nodes in batches will it crash. How can I solve this problem in a lightweight way without upgrading the version or replacing bdb? My current solution is to kill ns-slapd and then start-dirsrv. 389ds crashed logs tailf access ``` [29/Apr/2026:14:31:23 +0800] conn=19 op=2735 SRCH base="dc=yydevops,dc=com" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=krbt... [29/Apr/2026:14:31:25 +0800] conn=67 op=6 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:25 +0800] conn=67 op=6 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:28 +0800] conn=67 op=7 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:28 +0800] conn=67 op=7 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:31 +0800] conn=67 op=9 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:31 +0800] conn=67 op=9 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:34 +0800] conn=67 op=10 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:34 +0800] conn=67 op=10 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:37 +0800] conn=67 op=12 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:37 +0800] conn=67 op=12 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:40 +0800] conn=67 op=13 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:40 +0800] conn=67 op=13 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:43 +0800] conn=67 op=15 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:43 +0800] conn=67 op=15 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:46 +0800] conn=67 op=16 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:46 +0800] conn=67 op=16 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:49 +0800] conn=67 op=18 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:49 +0800] conn=67 op=18 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:52 +0800] conn=67 op=19 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:52 +0800] conn=67 op=19 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:55 +0800] conn=67 op=21 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:55 +0800] conn=67 op=21 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:31:58 +0800] conn=67 op=22 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:31:58 +0800] conn=67 op=22 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:32:01 +0800] conn=67 op=24 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:32:01 +0800] conn=67 op=24 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:32:03 +0800] conn=69 fd=95 slot=95 connection from local to /var/run/slapd-YYDEVOPS-COM.socket [29/Apr/2026:14:32:03 +0800] conn=69 op=-1 fd=95 closed - B1 [29/Apr/2026:14:32:03 +0800] conn=70 fd=95 slot=95 connection from local to /var/run/slapd-YYDEVOPS-COM.socket [29/Apr/2026:14:32:03 +0800] conn=70 AUTOBIND dn="cn=Directory Manager" [29/Apr/2026:14:32:03 +0800] conn=70 op=0 BIND dn="cn=Directory Manager" method=sasl version=3 mech=EXTERNAL [29/Apr/2026:14:32:03 +0800] conn=70 op=0 RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=Directory Manager" [29/Apr/2026:14:32:03 +0800] conn=70 op=1 SRCH base="cn=ipa-70-2.hiido.host.int.yy.com,cn=masters,cn=ipa,cn=etc,dc=yydevops,dc=com" scope=2 filter="(ipaConfigString=enabledService)" attrs="ipaConfigString cn" [29/Apr/2026:14:32:03 +0800] conn=70 op=1 RESULT err=0 tag=101 nentries=6 etime=0 notes=U [29/Apr/2026:14:32:03 +0800] conn=70 op=2 SRCH base="cn=schema" scope=0 filter="(objectClass=*)" attrs="attributeTypes objectClasses" [29/Apr/2026:14:32:03 +0800] conn=70 op=2 RESULT err=0 tag=101 nentries=1 etime=0 [29/Apr/2026:14:32:04 +0800] conn=67 op=25 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:32:04 +0800] conn=67 op=25 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:32:04 +0800] conn=70 op=3 UNBIND [29/Apr/2026:14:32:04 +0800] conn=70 op=3 fd=95 closed - U1 [29/Apr/2026:14:32:07 +0800] conn=67 op=27 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:32:07 +0800] conn=67 op=27 RESULT err=0 tag=120 nentries=0 etime=0 [29/Apr/2026:14:32:10 +0800] conn=67 op=28 EXT oid="2.16.840.1.113730.3.5.12" name="replication-multimaster-extop" [29/Apr/2026:14:32:10 +0800] conn=67 op=28 RESULT err=0 tag=120 nentries=0 etime=0 ``` gdb_threads.log ``` ....... Thread 34 (Thread 0x7f91757f2700 (LWP 3627)): #0 pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185 #1 0x00007f9333e5384d in __db_pthread_mutex_lock () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #2 0x00007f9333efc66c in __lock_get_internal () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #3 0x00007f9333efd087 in __lock_get () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #4 0x00007f9333f284b7 in __db_lget () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #5 0x00007f9333e7082d in __bam_search () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #6 0x00007f9333e5b8bc in ?? () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #7 0x00007f9333e5d9bf in ?? () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #8 0x00007f9333f14ea5 in __dbc_iget () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #9 0x00007f9333f23f82 in __dbc_get_pp () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #10 0x00007f932fe520ce in idl_new_fetch () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #11 0x00007f932fe60713 in index_read_ext_allids () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #12 0x00007f932fe4ac3d in ?? () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #13 0x00007f932fe4b452 in ?? () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #14 0x00007f932fe4ba3a in filter_candidates_ext () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #15 0x00007f932fe4ca3f in ?? () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #16 0x00007f932fe4b9a2 in filter_candidates_ext () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #17 0x00007f932fe4ca3f in ?? () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #18 0x00007f932fe4b9a2 in filter_candidates_ext () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #19 0x00007f932fe4ca3f in ?? () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #20 0x00007f932fe4b9a2 in filter_candidates_ext () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #21 0x00007f932fe871a7 in subtree_candidates () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #22 0x00007f932fe88733 in ldbm_back_search () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #23 0x00007f933ef1dd90 in op_shared_search () from /usr/lib/x86_64-linux-gnu/dirsrv/libslapd.so.0 #24 0x0000562002c216df in ?? () #25 0x0000562002c1030f in ?? () #26 0x00007f933de7e088 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so #27 0x00007f933da256ba in start_thread (arg=0x7f91757f2700) at pthread_create.c:333 #28 0x00007f933d75b41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 33 (Thread 0x7f9175ff3700 (LWP 3626)): #0 pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185 #1 0x00007f933de786a0 in PR_WaitCondVar () from /usr/lib/x86_64-linux-gnu/libnspr4.so #2 0x0000562002c0e09e in ?? () #3 0x0000562002c0f753 in ?? () #4 0x00007f933de7e088 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so #5 0x00007f933da256ba in start_thread (arg=0x7f9175ff3700) at pthread_create.c:333 #6 0x00007f933d75b41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 32 (Thread 0x7f91767f4700 (LWP 3625)): #0 pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185 #1 0x00007f933de786a0 in PR_WaitCondVar () from /usr/lib/x86_64-linux-gnu/libnspr4.so #2 0x0000562002c0e09e in ?? () #3 0x0000562002c0f753 in ?? () #4 0x00007f933de7e088 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so #5 0x00007f933da256ba in start_thread (arg=0x7f91767f4700) at pthread_create.c:333 #6 0x00007f933d75b41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 31 (Thread 0x7f9176ff5700 (LWP 3624)): #0 pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185 #1 0x00007f933de786a0 in PR_WaitCondVar () from /usr/lib/x86_64-linux-gnu/libnspr4.so #2 0x0000562002c0e09e in ?? () #3 0x0000562002c0f753 in ?? () #4 0x00007f933de7e088 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so #5 0x00007f933da256ba in start_thread (arg=0x7f9176ff5700) at pthread_create.c:333 #6 0x00007f933d75b41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 30 (Thread 0x7f91777f6700 (LWP 3623)): #0 0x00007f933da2a730 in futex_wait (private=<optimized out>, expected=0, futex_word=0x7f92e9eaeb0c) at ../sysdeps/unix/sysv/linux/futex-internal.h:61 #1 futex_wait_simple (private=<optimized out>, expected=0, futex_word=0x7f92e9eaeb0c) at ../sysdeps/nptl/futex-internal.h:135 #2 __pthread_rwlock_wrlock_slow (rwlock=0x7f92e9eaeb00) at pthread_rwlock_wrlock.c:67 #3 0x00007f9333e536d7 in __db_pthread_mutex_lock () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #4 0x00007f9333f6abbb in __memp_fget () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #5 0x00007f9333e70307 in __bam_search () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #6 0x00007f9333e5b8bc in ?? () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #7 0x00007f9333e5fde5 in ?? () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #8 0x00007f9333f158a1 in __dbc_iput () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #9 0x00007f9333f10a25 in __db_put () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #10 0x00007f9333f26593 in __db_put_pp () from /usr/lib/x86_64-linux-gnu/libdb-5.3.so #11 0x00007f932fe52f7f in idl_new_insert_key () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #12 0x00007f932fe62174 in ?? () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #13 0x00007f932fe62d04 in index_addordel_values_ext_sv () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #14 0x00007f932fe63161 in index_addordel_values_sv () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #15 0x00007f932fe63217 in index_addordel_entry () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #16 0x00007f932fe65f5a in ldbm_back_add () from /usr/lib/x86_64-linux-gnu/dirsrv/plugins/libback-ldbm.so #17 0x00007f933eecf6ba in ?? () from /usr/lib/x86_64-linux-gnu/dirsrv/libslapd.so.0 #18 0x00007f933eed0a38 in do_add () from /usr/lib/x86_64-linux-gnu/dirsrv/libslapd.so.0 #19 0x0000562002c103e8 in ?? () #20 0x00007f933de7e088 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so #21 0x00007f933da256ba in start_thread (arg=0x7f91777f6700) at pthread_create.c:333 #22 0x00007f933d75b41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 Thread 29 (Thread 0x7f9177ff7700 (LWP 3622)): #0 pthread_cond_wait@@GLIBC_2.3.2 () at ../sysdeps/unix/sysv/linux/x86_64/pthread_cond_wait.S:185 #1 0x00007f933de786a0 in PR_WaitCondVar () from /usr/lib/x86_64-linux-gnu/libnspr4.so #2 0x0000562002c0e09e in ?? () #3 0x0000562002c0f753 in ?? () #4 0x00007f933de7e088 in ?? () from /usr/lib/x86_64-linux-gnu/libnspr4.so #5 0x00007f933da256ba in start_thread (arg=0x7f9177ff7700) at pthread_create.c:333 #6 0x00007f933d75b41d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109 ...... ```

2 1

uname to login
by Frederic Ayrault 12 May '26

12 May '26

Bonjour, I was adding and remove SSH key to do some test when I was loggoff from the GUI and I am not able to loggin anymore. I tried ipa user-mod fred --password and ipa user-mod fred --random, both seems to work, but I am still enable to login When I try to change the password from the GUI using the admin account I get > Erreur IPA 4031: EmptyResult > no matching entry found if I try an kinit fred, I get > kinit: Client 'fred(a)LIX.POLYTECHNIQUE.FR' not found in Kerberos > database while getting initial credentials I did an ldapsearch before loosing access add one difference with now is one object is added > objectClass: ipauserauthtypeclass Do you have any ideas ? Thank you for your help Regards, Frederic Frédéric AYRAULT Administrateur Systèmes et Réseaux Laboratoire d'Informatique de l'Ecole polytechnique <http://www.lix.polytechnique.fr> fred(a)lix.polytechnique.fr

3 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2026