FreeIPA-users July 2026

freeipa-users@lists.fedorahosted.org

15 participants
8 discussions

EL9 IPA servers hanging on shutdown
by Orion Poplawski 25 Aug '26

25 Aug '26

We're seeing our EL9 IPA server VMs get stuck often at: A stop job is running for Identity, Policy, Audit Is anyone else seeing this? How can I avoid it? -- Orion Poplawski he/him/his - surely the least important thing about me IT Systems Manager 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

2 2

Issue with modern UI
by Orion Poplawski 10 Aug '26

10 Aug '26

We're running IPA on EL9. With the classic UI I can log out of my default user that auto logins with GSSAPI and then login as the admin. With the "modern UI" the logout button does nothing and I just keep going back to the modern UI. The "Profile" section also seems to do nothing. Are these known issues? I'd hate to eventually get stuck with only the modern UI and not be able to log out. Orion -- Orion Poplawski he/him/his - surely the least important thing about me Manager of IT Systems 720-772-5637 NWRA, Boulder Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

3 3

Best way to upgrade FreeIpa version and OS
by Youssef CHTOUROU 26 Jul '26

26 Jul '26

Hello I've 3 FreeIpa Servers (version =4.6.8) runned on Centos 7. I'am looking for upgrade these servers like that : Centos 7 to Rocky 8 FreeIpa server to most recent version possible I would like to see your advice : what is the best / secure way to do this upgrade ? Thanks a lot

2 1

Separate OTP for IdP
by Perry Naseck 26 Jul '26

26 Jul '26

Hi, I have FreeIPA + Keycloak set up in Podman on one machine. Because they are in Podman, I connected Keycloak to FreeIPA via LDAP + Kerberos instead of SSSD. Keycloak has a service account in FreeIPA to do this. Is there a way to enforce Keycloak's LDAP/Kerberos authentication checks to use password only and not password + OTP? Can the user authentication types be configured per-service account or otherwise? I still want password + OTP when a user uses kinit or SSH's into a server. Keycloak's own OTP system makes more sense for users primarily using web applications, so I want to keep those parts separate. Thanks! Perry

2 5

Replication failing to new node
by David Eddleman 24 Jul '26

24 Jul '26

I've setup a FreeIPA server and joined it to AD via one-way trust. I'm attempting to add new master nodes to the server for redundancy and it's failing on the setting up initial replication step: [26/40]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 15 seconds elapsed [ldap://server:389] reports: Update failed! Status: [Error (-2) - LDAP error: Local error - no response received] [error] RuntimeError: Failed to start replication Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. Failed to start replication The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information [root@server2 ~]# nc -vz server1 389 Ncat: Version 7.92 ( https://nmap.org/ncat ) Ncat: Connected to ip:389. Ncat: 0 bytes sent, 0 bytes received in 0.02 seconds. [root@server2 ~]# nc -vzu server1 389 Ncat: Version 7.92 ( https://nmap.org/ncat ) Ncat: Connected to ip:389. 0▒e▒ ^C What should I be checking on the one master? Services seem to be up and running, I'm not sure what would be 'blocking' the request. They're on the same network segment so no traffic should be getting intercepted between them. No firewall on either, firewalld is dead and masked. What's even more confusing, attempting the replica install again now tells me that there's a replication agreement between these two boxes. Checking the current master I see no other servers in the topology and attempting to run `ipa server-del server2 --force` succeeds but without --force it tells me that no such server exists.

2 3

sudo not working anymore after upgrade to Ubuntu 26
by Andreas Bulling 17 Jul '26

17 Jul '26

Hi all, I've been running FreeIPA without major issues for years, connecting various Ubuntu machines as clients - most running Ubuntu 24. I upgraded three of them to Ubuntu 26 today and noticed that, while I can still login using SSH (public-key auth), sudo is not working anymore. I have not touched the sudoers configuration on the FreeIPA server side - I just updated Ubuntu on these three servers. Those running Ubuntu 24 are still working fine incl. sudo This is what I see in /var/log/auth.log 2026-07-17T16:57:52.122663+02:00 cloud sshd-session[3029]: Accepted publickey for REDACTED from REDACTED port 53988 ssh2: RSA REDACTED 2026-07-17T16:57:52.138883+02:00 cloud sshd-session[3029]: pam_unix(sshd:session): session opened for user REDACTED(uid=REDACTED) by REDACTED(uid=0) 2026-07-17T16:57:52.162575+02:00 cloud systemd-logind[1387]: New session '34' of user 'REDACTED' with class 'user' and type 'tty'. 2026-07-17T16:57:52.213586+02:00 cloud (systemd): pam_sss(systemd-user:account): Access denied for user REDACTED: 6 (Permission denied) 2026-07-17T16:57:52.213829+02:00 cloud (systemd): PAM PAM failed: Permission denied Not sure which other logfiles might be useful for debugging - here are two that are probably involved: # /etc/nsswitch.conf # # Example configuration of GNU Name Service Switch functionality. # If you have the `glibc-doc-reference' and `info' packages installed, try: # `info libc "Name Service Switch"' for information about this file. passwd: files systemd sss group: files systemd sss shadow: files sss gshadow: files hosts: files dns networks: files protocols: db files services: db files sss ethers: db files rpc: db files netgroup: nis sss sudoers: files sss automount: sss ii freeipa-client 4.13.1-1 amd64 FreeIPA centralized identity framework -- client ii freeipa-common 4.13.1-1 all FreeIPA centralized identity framework -- common files sudo -l sudo: Sorry, user REDACTED may not run sudo on REDACTED.

7 10

FreeIPA 4.13.2
by Antonio Torres 16 Jul '26

16 Jul '26

The FreeIPA team would like to announce the FreeIPA 4.13.2 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. Full release notes are available at: https://www.freeipa.org/release-notes/4-13-2.html

1 0

How to restrict a user to only view its own entry?
by Alex Crow 14 Jul '26

14 Jul '26

I've been trying to no avail to get this to work - I have a couple of users that I want to be able to bind via simple LDAP over TLS but only see their own entry. I've been playing with Roles, Privileges and Permissions but I can't get this to work. One of the parts I've seen in some online documentation says to create a normal permissions, with read search and compare rights, and use an "Extra Target Filter" of "(uid=${user})". Despite assigning this to a Privilege and a Role, and giving only that role to an account, that account can still read everyone else's entries and attributes. Is there any way to make this work? This is my permission entry: # ipa permission-show "Only access self" Permission name: Only access self Granted rights: read, search, compare Effective attributes: cn, createtimestamp, employeetype, entryusn, givenname, homedirectory, loginshell, mail, memberof, mobile, modifytimestamp, objectclass, ou, sn, title, uid, uidnumber, usercertificate Bind rule type: permission Subtree: cn=users,cn=accounts,dc=ipa,dc=roadtech,dc=internal Extra target filter: (uid=${user}) Target DN: cn=users,cn=accounts,dc=ipa,dc=roadtech,dc=internal Type: user Permission flags: SYSTEM, V2 Granted to Privilege: restricted_user Indirect Member of roles: Only self Now what I'm unsure of is the extra filter, does this variable "$user" even exist? I can't find anything in the IPA docs about variables that can be used in filters. I've also tried changing $user to the actual UID of the user I'm working with and it still had no effect, the user can still see everything (unprivileged attributes only but all the rest are there).

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2026