FreeIPA-users June 2026

freeipa-users@lists.fedorahosted.org

10 participants
7 discussions

EL9 IPA servers hanging on shutdown
by Orion Poplawski 25 Aug '26

25 Aug '26

We're seeing our EL9 IPA server VMs get stuck often at: A stop job is running for Identity, Policy, Audit Is anyone else seeing this? How can I avoid it? -- Orion Poplawski he/him/his - surely the least important thing about me IT Systems Manager 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

2 2

Best way to upgrade FreeIpa version and OS
by Youssef CHTOUROU 26 Jul '26

26 Jul '26

Hello I've 3 FreeIpa Servers (version =4.6.8) runned on Centos 7. I'am looking for upgrade these servers like that : Centos 7 to Rocky 8 FreeIpa server to most recent version possible I would like to see your advice : what is the best / secure way to do this upgrade ? Thanks a lot

2 1

IPA Clients not doing resolving hosts in DNS Forward zone
by Kris C 25 Jun '26

25 Jun '26

I have a client that lives in the DNS domain happyplace.org. My corporate overlords want to attach their network to mine. I need to be able to resolve their hosts on eviloverlords.com. In FreeIPA I configured eviloverlords.com in the DNS forward zones. I have two ip address that their requests should be forwarded to 6.6.6.1 and 6.6.6.2, and the policy is set to forward only. I am able to resolve eviloverlords.com from the FreeIPA servers, I am unable to resolve them from the clients. From an happyplace.org host, if I do an nslookup and specifically request a dns entry from 6.6.6.1 or 6.6.6.2, I am able to resolve them. I am unable to resolve the host if I just do a nslookup boss.eviloverlords.com. I'm running FreeIPA 4.9.13. Why is my IdM server not serving up the records for eviloverlords.com? Domain names and ip address have been changed to protect the innocent and FreeIPA version I'm using isn't exactly Free (hint hint) ;-)

2 1

ipa-replica-install failing at initial replication
by Tania Hagan 22 Jun '26

22 Jun '26

Hi FreeIPA users, I'm attempting to install a replica on Rocky 10 from an existing replica on Rocky 9. On the replica I see: sudo grep -iE "critical|error|exception" /var/log/ipareplica-install.log 2026-05-14T15:36:52Z DEBUG Entry found [LDAPEntry(ipapython.dn.DN('cn=meToipa-lon-3.thomac.net,cn=replica,cn=dc\=thomac\,dc\=net,cn=mapping tree,cn=config'), {'objectClass': [b'nsds5replicationagreement', b'top'], 'cn': [b'meToipa-lon-3.thomac.net'], 'nsDS5ReplicaHost': [b'ipa-lon-3.thomac.net'], 'nsDS5ReplicaPort': [b'389'], 'nsds5replicaTimeout': [b'120'], 'nsDS5ReplicaRoot': [b'dc=thomac,dc=net'], 'description': [b'me to ipa-lon-3.thomac.net'], 'nsDS5ReplicatedAttributeList': [b'(objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime'], 'nsDS5ReplicaTransportInfo': [b'LDAP'], 'nsDS5ReplicaBindMethod': [b'SASL/GSSAPI'], 'nsds5ReplicaStripAttrs': [b'modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp'], 'nsDS5ReplicatedAttributeListTotal': [b'(objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime'], 'nsds5replicareapactive': [b'0'], 'nsds5replicaLastUpdateStart': [b'19700101000000Z'], 'nsds5replicaLastUpdateEnd': [b'19700101000000Z'], 'nsds5replicaChangesSentSinceStartup': [b''], 'nsds5replicaLastUpdateStatus': [b'Error (49) Problem connecting to replica - LDAP error: Invalid credentials (connection error)'], 'nsds5replicaLastUpdateStatusJSON': [b'{"state": "red", "ldap_rc": "49", "ldap_rc_text": "Invalid credentials", "repl_rc": "16", "repl_rc_text": "connection error", "date": "2026-05-14T15:36:52Z", "message": "Error (49) Problem connecting to replica - LDAP error: Invalid credentials (connection error)"}'], 'nsds5replicaUpdateInProgress': [b'FALSE'], 'nsds5replicaLastInitStart': [b'19700101000000Z'], 'nsds5replicaLastInitEnd': [b'19700101000000Z']})] 2026-05-14T15:36:52Z DEBUG Entry found [LDAPEntry(ipapython.dn.DN('cn=meToipa-lon-1.thomac.net,cn=replica,cn=dc\=thomac\,dc\=net,cn=mapping tree,cn=config'), {'objectClass': [b'nsds5replicationagreement', b'top'], 'cn': [b'meToipa-lon-1.thomac.net'], 'nsDS5ReplicaHost': [b'ipa-lon-1.thomac.net'], 'nsDS5ReplicaPort': [b'389'], 'nsds5replicaTimeout': [b'120'], 'nsDS5ReplicaRoot': [b'dc=thomac,dc=net'], 'description': [b'me to ipa-lon-1.thomac.net'], 'nsDS5ReplicatedAttributeList': [b'(objectclass=*) $ EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime'], 'nsDS5ReplicaTransportInfo': [b'LDAP'], 'nsDS5ReplicaBindMethod': [b'SASL/GSSAPI'], 'nsds5ReplicaStripAttrs': [b'modifiersName modifyTimestamp internalModifiersName internalModifyTimestamp'], 'nsDS5ReplicatedAttributeListTotal': [b'(objectclass=*) $ EXCLUDE entryusn krblastsuccessfulauth krblastfailedauth krbloginfailedcount passwordgraceusertime'], 'nsds5replicareapactive': [b'0'], 'nsds5replicaLastUpdateStart': [b'19700101000000Z'], 'nsds5replicaLastUpdateEnd': [b'19700101000000Z'], 'nsds5replicaChangesSentSinceStartup': [b''], 'nsds5replicaLastUpdateStatus': [b'Error (0) No replication sessions started since server startup'], 'nsds5replicaLastUpdateStatusJSON': [b'{"state": "green", "ldap_rc": "0", "ldap_rc_text": "success", "repl_rc": "0", "repl_rc_text": "replica acquired", "date": "2026-05-14T15:36:52Z", "message": "Error (0) No replication sessions started since server startup"}'], 'nsds5replicaUpdateInProgress': [b'FALSE'], 'nsds5replicaLastInitStart': [b'19700101000000Z'], 'nsds5replicaLastInitEnd': [b'19700101000000Z']})] raise RuntimeError("Failed to start replication") RuntimeError: Failed to start replication 2026-05-14T15:38:58Z DEBUG [error] RuntimeError: Failed to start replication File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458, in _handle_exception File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 468, in _handle_execute_exception self._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 526, in _handle_exception self.__parent._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458, in _handle_exception File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 523, in _handle_exception super(ComponentBase, self)._handle_exception(exc_info) File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458, in _handle_exception raise RuntimeError("Failed to start replication") 2026-05-14T15:38:58Z DEBUG The ipa-replica-install command failed, exception: RuntimeError: Failed to start replication 2026-05-14T15:38:58Z ERROR Failed to start replication 2026-05-14T15:38:58Z ERROR The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information and on the existing replica I see: [14/May/2026:15:37:10.784513370 +0000] - WARN - content-sync-plugin - sync_update_persist_betxn_pre_op - DB retried operation targets "changenumber=68535600,cn=changelog" (op=0x7f62b0043800 idx_pl=1) => op not changed in PL [14/May/2026:15:38:50.526377911 +0000] - WARN - content-sync-plugin - sync_update_persist_betxn_pre_op - DB retried operation targets "changenumber=68535707,cn=changelog" (op=0x7f638133b800 idx_pl=1) => op not changed in PL [14/May/2026:15:38:50.590699199 +0000] - WARN - NSMMReplicationPlugin - replica_generate_next_csn - opcsn=6a05ee16000500340000 <= basecsn=6a05ee17000600300000, adjusted opcsn=6a05ee17000700340000 [14/May/2026:15:38:57.511706451 +0000] - ERR - NSMMReplicationPlugin - perform_operation - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): Failed to send extended operation: LDAP error -1 (Can't contact LDAP server) [14/May/2026:15:38:57.517218118 +0000] - ERR - NSMMReplicationPlugin - repl5_tot_log_operation_failure - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): Received error -1 (Can't contact LDAP server): for total update operation [14/May/2026:15:38:57.520123870 +0000] - ERR - NSMMReplicationPlugin - release_replica - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): Unable to send endReplication extended operation (Can't contact LDAP server) [14/May/2026:15:38:57.522323162 +0000] - ERR - NSMMReplicationPlugin - repl5_tot_run - Total update failed for replica "agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389)", error (-11) [14/May/2026:15:38:57.524104058 +0000] - ERR - NSMMReplicationPlugin - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): Total update flow control triggered 59 times You may increase nsds5ReplicaFlowControlPause and/or decrease nsds5ReplicaFlowControlWindow in the replica agreement configuration [14/May/2026:15:38:57.816155969 +0000] - INFO - NSMMReplicationPlugin - bind_and_check_pwp - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): Replication bind with GSSAPI auth resumed [14/May/2026:15:38:58.098378634 +0000] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. [14/May/2026:15:39:00.874788979 +0000] - WARN - NSMMReplicationPlugin - repl5_inc_run - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): The remote replica has a different database generation ID than the local database. You may have to reinitialize the remote replica, or the local replica. I remove the replica by running: On the existing replica: ipa-replica-manage del ipa-lon-3.thomac.net --force --cleanup ipa server-del ipa-lon-3.thomac.net ipa host-del ipa-lon-3.thomac.net dsconf -D "cn=Directory Manager" ldaps://localhost repl-agmt delete --suffix "dc=thomac,dc=net" meToipa-lon-3.thomac.net and find no replica agreements with ipa topologysegment-find ca, and ipa topologysegment-find domain On the new replica: ipa-server-install --uninstall -U and kdestroy -A When I attempt a reinstall I run: ipa-client-install --server ipa-lon-1.thomac.net --domain=thomac.net Make sure to add A record with PTR kinit admin ipa hostgroup-add-member ipaservers --hosts ipa-lon-3.thomac.net ipa-replica-install --principal admin -v and it still fails. The vms are on the same network, subnet, and have the same mtu ipa-healthcheck returns [] the clock is the same dig and host is good from both machines I've also tried the command to a different replica and it still fails I was able to upgrade my poc freeipa from rocky 9 and rocky 10 fine using both manual commands and ansible playbook, but my production freeipa replicas are failing. Any ideas of anything else I can try? Many Thanks, Tania

3 7

Can't renew certs automatically
by Duc Tran Ngoc 16 Jun '26

16 Jun '26

Hello all, When I run "getcert list" cmd, I see these 4 certs that will be expired on 20 days and cannot be renewed automatically. Can anyone help me? Request ID '20260309084023': status: MONITORING ca-error: Server at https://hostname.domain.com/ipa/json denied our request, giving up: 3009 (invalid 'csr': hostname in subject of request 'IPA RA' does not match name or aliases of principal 'host/hostname.domain.com(a)DOMAIN.COM'). stuck: no key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=DOMAIN.COM subject: CN=IPA RA,O=DOMAIN.COM issued: 2024-07-02 08:47:04 UTC expires: 2026-06-22 08:47:04 UTC key usage: digitalSignature,keyEncipherment,dataEncipherment eku: id-kp-clientAuth profile: caSubsystemCert pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes Request ID '20260309084024': status: MONITORING ca-error: Server at https://hostname.domain.com/ipa/json denied our request, giving up: 3009 (invalid 'csr': hostname in subject of request 'CA Audit' does not match name or aliases of principal 'host/hostname.domain.com(a)DOMAIN.COM'). stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='auditSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=DOMAIN.COM subject: CN=CA Audit,O=DOMAIN.COM issued: 2024-07-02 08:46:01 UTC expires: 2026-06-22 08:46:01 UTC key usage: digitalSignature,nonRepudiation profile: caSignedLogCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "auditSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20260309084025': status: MONITORING ca-error: Server at https://hostname.domain.com/ipa/json denied our request, giving up: 3009 (invalid 'csr': hostname in subject of request 'OCSP Subsystem' does not match name or aliases of principal 'host/hostname.domain.com(a)DOMAIN.COM'). stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='ocspSigningCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=DOMAIN.COM subject: CN=OCSP Subsystem,O=DOMAIN.COM issued: 2024-07-02 08:45:43 UTC expires: 2026-06-22 08:45:43 UTC eku: id-kp-OCSPSigning profile: caOCSPCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "ocspSigningCert cert-pki-ca" track: yes auto-renew: yes Request ID '20260309084026': status: MONITORING ca-error: Server at https://hostname.domain.com/ipa/json denied our request, giving up: 3009 (invalid 'csr': hostname in subject of request 'CA Subsystem' does not match name or aliases of principal 'host/hostname.domain.com(a)DOMAIN.COM'). stuck: no key pair storage: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB',pin set certificate: type=NSSDB,location='/etc/pki/pki-tomcat/alias',nickname='subsystemCert cert-pki-ca',token='NSS Certificate DB' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=DOMAIN.COM subject: CN=CA Subsystem,O=DOMAIN.COM issued: 2024-07-02 08:45:55 UTC expires: 2026-06-22 08:45:55 UTC key usage: digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment eku: id-kp-clientAuth profile: caSubsystemCert pre-save command: /usr/libexec/ipa/certmonger/stop_pkicad post-save command: /usr/libexec/ipa/certmonger/renew_ca_cert "subsystemCert cert-pki-ca" track: yes auto-renew: yes

3 6

FreeIPA on VLAN network
by Olivier G 08 Jun '26

08 Jun '26

Hi all, Do you know if there is any issue with the following architecture: * One server connected to multiple VLAN * One FreeIpa replica listening to multiples interfaces on the different VLAN (with each having different IP addresse) * one DNS declaration (with a different application name) per VLAN with associated IP address with associated certificate => The VLAN segregation is managed manually. Ex: I have a freeipa replica named app with: app1.network.local on VLAN1 / IP1 / certificate 1 app2.network.local on VLAN2 / IP2/ certificate 2 Is there a better architecture? Does Kerberos will have issues with this configuration? Thanks for reading. Olivier

2 3

New users can't log in with expired passwords
by Aram Akhavan 04 Jun '26

04 Jun '26

As documented in https://www.freeipa.org/page/New_Passwords_Expired I can see that when an admin creates a new user or resets a password, it is immediately expired. Users can log in and immediately change it. However, I'm unable to get that to work whether from the web gui, ssh, or anything else. I've created a test user with admin privileges; it's password is expired. I try logging into the web UI, and it says "The password or username you entered is incorrect", nothing about an expired password (I know the password is right!). The response header of the GUI POST request has X-IPA-Rejection-Reason: invalid-password, not X-IPA-Rejection-Reason: password-expired as is suggested here: https://github.com/freeipa/freeipa-webui/discussions/29 If I log in to the ipa server with my own user account (which somehow, I managed to create and use without issue...), and try to do an `su test`, I see krb5_child complain: Password has expired. It seems impossible to log in with an expired password. Yet my own user account was created, so presumably I changed some setting but I can't for the life of me figure out what I changed. Thanks for the help!

3 5

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users June 2026