FreeIPA-users

freeipa-users@lists.fedorahosted.org

10 participants
4908 discussions

DNSSEC does not replicate between masters ?
by listy 14 Aug '26

14 Aug '26

Hi guys. I have a peculiar situation, so I think. My DNS master does not, or other masters do not, sync DNSSEC records. Eg. on the master: -> $ dig mine.priv SOA +dnssec and I get RRSIG record, do the same on replicas/masters and the record is absent. Otherwise I cannot spot any obvious errors in logs nor in usual places. Any suggestions as to what might be (not)happening, are much appreciated. thanks, L.

1 1

SSL Error on enrolling
by alexey safonov 14 Aug '26

14 Aug '26

Hi, previously I had strange situation, where one certificate had expired I've fixed this with ipa-cert-fix, but still have this: Number of certificates and requests being tracked: 7. Request ID '20240815074547': status: CA_UNREACHABLE ca-error: Server at https://host01.int.domain/ipa/json failed request, will retry: 4016 (503 Server Error: Service Unavailable for url: https://host01.int.domain:443/ca/rest/account/login) stuck: no key pair storage: type=FILE,location='/var/lib/ipa/ra-agent.key' certificate: type=FILE,location='/var/lib/ipa/ra-agent.pem' CA: dogtag-ipa-ca-renew-agent issuer: CN=Certificate Authority,O=INT.QUANTBOX.IN subject: CN=IPA RA,O=INT.QUANTBOX.IN issued: 2026-08-06 16:44:29 IST expires: 2028-07-26 16:44:29 IST key usage: digitalSignature,keyEncipherment,dataEncipherment eku: id-kp-clientAuth profile: caSubsystemCert pre-save command: /usr/libexec/ipa/certmonger/renew_ra_cert_pre post-save command: /usr/libexec/ipa/certmonger/renew_ra_cert track: yes auto-renew: yes I feel that everything works fine, but today I see that on enrolling have the following error. ipa-client-install --uninstall Unenrolling client from IPA server Unenrolling host failed: Certificate operation cannot be completed: HTTPSConnectionPool(host='hos01.int.domain', port=443): Max retries exceeded with url: /ca/rest/certs/search?size=5000 (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_CERTIFICATE_EXPIRED] ssl/tls alert certificate expired (_ssl.c:2651)'))) What should I check here and any ideas how to fix?

2 7

Failed to build range candidate list on entryusn index
by Orion Poplawski 14 Aug '26

14 Aug '26

I've been starting to see these messages in some of our IPA servers: [08/Aug/2026:03:00:29.126842569 -0600] - ERR - idl_new_range_fetch - Failed to build range candidate list on entryusn index. Error is -12795 [08/Aug/2026:03:00:29.128977448 -0600] - ERR - build_candidate_list - Database error -12795 Any idea what this means? Google came up empty. Orion -- Orion Poplawski he/him/his - surely the least important thing about me Manager of IT Systems 720-772-5637 NWRA, Boulder Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

2 1

Samba ROLE_DOMAIN_MEMBER - Unable to connect to DC ?
by listy 12 Aug '26

12 Aug '26

Hi guys. I have smb clients are unable to connect with Samba server which is on IPA client, Samba is ROLE_DOMAIN_MEMBER Such Samba server logs: ``` [2026/08/12 14:41:18.966193, 0, traceid=32] ../../source3/winbindd/winbindd_cm.c:3435(cm_connect_netlogon) cm_connect_netlogon: Unable to connect to DC ipa-dzien.mine.priv of domain MINE over TCP/IP: NT_STATUS_CONNECTION_REFUSED. Please check your firewall if it allows connections to port 135 and port range 49152-65535 over TCP/IP! [2026/08/12 14:41:25.966577, 1, traceid=32] ../../source3/libads/ldap.c:610(cldap_ping_list) cldap_ping_list: realm[MINE.PRIV] no valid response num_requests[1] for count[2] - NT_STATUS_NO_LOGON_SERVERS ``` and there certainly - on IPA Samba ROLE_IPA_DC (ipa-dzien.mine.priv) - Samba is not listening on those ports. I must be missing or doing something wrong - so I assume since it's well established IPA's set of futures - would it be ROLE_DOMAIN_MEMBER box or IPA's ROLE_IPA_DC end? I do not spot any obvious errors in IPA's logs, regular checks also do not warn of something. All Samba installs also went without errors. many thanks, L.

1 0

Samba domain member fails with NT_STATUS_INVALID_PARAMETER_MIX against FreeIPA IPA_DC
by simonin florian 11 Aug '26

11 Aug '26

Samba domain member fails with NT_STATUS_INVALID_PARAMETER_MIX against FreeIPA IPA_DC (ipa-adtrust-install) Summary After successfully enrolling a Samba file server as a FreeIPA client ( ipa-client-install) and running ipa-client-samba to configure it as a domain member, winbindd fails to establish the NETLOGON secure channel with the FreeIPA server (configured as ROLE_IPA_DC via ipa-adtrust-install). wbinfo -t consistently fails with NT_STATUS_INVALID_PARAMETER_MIX, regardless of Samba version (tested 4.22, 4.23, 4.24) or netlogon-crypto compatibility settings. Environment - *FreeIPA server*: auth-nibelle-01, Rocky Linux 9, Samba 4.23.5 ( samba-dcerpc, samba-winbind, freeipa-server-trust-ad installed), realm INFRA.AMANETIS.FR, server role IPA PRIMARY DOMAIN CONTROLLER (ipasam passdb backend). - *Samba member server*: fs-fauneharmony-01, Debian 13 (Trixie), Samba (tested at 4.22.10-Debian, then upgraded to 4.24.5 via trixie-backports — same result on both). - Both machines are on the same internal network (different VLANs, routed, no firewall blocking observed — verified with nc/ss). - DNS SRV records for _ldap/_kerberos manually added (FreeIPA-integrated DNS not used; internal Bind9 used instead). Steps already performed (in order) 1. ipa-client-install on fs-fauneharmony-01 — succeeded, host enrolled, Kerberos keytab present, getent passwd/group resolves FreeIPA identities correctly via SSSD. 2. ipa-adtrust-install --add-sids on auth-nibelle-01 — completed successfully ("Setup complete"), added Samba/NETLOGON support, DNS SRV records added manually as instructed by the installer output. 3. Initial attempts with net ads join -U admin on the member server all failed (Access Denied, then NetBIOS name >15 chars, then Error connecting to LSA pipe: NT_STATUS_CONNECTION_REFUSED, then NT_STATUS_OBJECT_NAME_NOT_FOUND after various RPC config changes — see below). We since learned from FreeIPA's own documentation that net ads join is *not supported* against ipasam and should not be used. 4. Installed freeipa-client-samba and ran *ipa-client-samba* instead (the documented correct tool) — completed successfully after working around one packaging issue (see "Side issues" below). It reports "Samba domain member is already configured" on subsequent runs. 5. klist -k /etc/samba/samba.keytab shows the correct cifs/ fs-fauneharmony-01.infra.amanetis.fr(a)INFRA.AMANETIS.FR principal. 6. net getlocalsid / net getdomainsid both return valid, consistent SIDs (machine SID and domain SID INFRA). 7. wbinfo -t still fails: checking the trust secret for domain INFRA via RPC calls failedwbcCheckTrustCredentials(INFRA): error code was NT_STATUS_INVALID_PARAMETER_MIX (0xc0000030)failed to call wbcCheckTrustCredentials: WBC_ERR_AUTH_ERROR Relevant log excerpt (client, log.wb-INFRA, debug level 5) ldb: Unable to open tdb '/var/lib/samba/private/secrets.ldb': No such file or directory ldb: Failed to connect to '/var/lib/samba/private/secrets.ldb' with backend 'tdb': ... source3/winbindd/winbindd_cm.c:3256(cm_connect_netlogon_transport) rpccli_create_netlogon_creds failed for INFRA, unable to create NETLOGON credentials: NT_STATUS_INVALID_PARAMETER_MIX The secrets.ldb failure appears to be a benign fallback attempt (file genuinely doesn't exist on a source3-only member; secrets.tdb exists and has valid content). The actual failure is in rpccli_create_netlogon_creds. What we've already tried, with no change in the error - Full reboot of both auth-nibelle-01 and fs-fauneharmony-01. - Upgrading client Samba from 4.22.10 (Debian stable) to 4.24.5 ( trixie-backports) — ruled out a simple version-skew hypothesis (server is 4.23.5). - Setting reject md5 servers = no, require strong key = no, client schannel = yes / server schannel = yes on both sides (via net conf setparm in the Samba registry on the FreeIPA server, and directly in smb.conf on the Debian member, since the member's smb.conf does not use include = registry). - Switching rpc_server:epmapper/lsarpc/lsass/samr/netlogon and rpc_daemon:epmd from external to embedded on the FreeIPA server (this was needed separately to get past an earlier Cannot start in standalone mode error from samba-dcerpcd, since no systemd unit ships to run it as an external/on-demand-activated daemon on this Rocky packaging). - Verified no firewall (neither Proxmox virtual firewall nor nftables/ firewalld on either host) is blocking traffic; TCP 445/139 reachable, CLDAP (net ads lookup) succeeds and returns full, correct DC information. Side issues encountered along the way (may or may not be relevant, noted for completeness) - samba-dcerpcd (RHEL/Rocky package) has no systemd unit and refuses to run standalone if rpc start on demand helpers = true (the implicit default) — worked around via net conf setparm global "rpc start on demand helpers" no plus switching relevant rpc_server:*/rpc_daemon:* parameters to embedded. - ipa-client-samba failed on first run with Cannot map BUILTIN\Guests to a group "nobody" because Debian's equivalent group is nogroup, not nobody — worked around with groupadd -o -g 65534 nobody before re-running. - NetBIOS name had to be manually shortened (netbios name = FS-FAUNEHARMONY — 15 chars) since the FQDN-derived name exceeded the 15-character NetBIOS limit. Question What could cause rpccli_create_netlogon_creds to fail with NT_STATUS_INVALID_PARAMETER_MIX specifically when establishing the NETLOGON secure channel between a classic Samba (source3) domain member and a FreeIPA server configured as ROLE_IPA_DC via ipa-adtrust-install? Is there a known incompatibility, a required additional parameter, or a documented working configuration for this specific combination (FreeIPA ipasam-backed DC + separate Samba file server as domain member) that we might be missing? Happy to provide any additional logs (higher debug levels, wireshark/tcpdump capture of the RPC exchange, net conf list output from both sides, etc.) on request.

2 1

Issue with modern UI
by Orion Poplawski 10 Aug '26

10 Aug '26

We're running IPA on EL9. With the classic UI I can log out of my default user that auto logins with GSSAPI and then login as the admin. With the "modern UI" the logout button does nothing and I just keep going back to the modern UI. The "Profile" section also seems to do nothing. Are these known issues? I'd hate to eventually get stuck with only the modern UI and not be able to log out. Orion -- Orion Poplawski he/him/his - surely the least important thing about me Manager of IT Systems 720-772-5637 NWRA, Boulder Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

3 3

Delete DNS Zone: Not allowed on non-leaf entry & invalid 'del_all': Zone record '@' cannot be deleted
by Anthony Messina 04 Aug '26

04 Aug '26

My network topology has changed and I'd like to remove a reverse DNS zone that is no longer applicable. When I try to delete the zone, I get an error "Not allowed on non-leaf entry." The only entry in the zone is the "@" record name with two NS entries corresponding to my two FreeIPA name servers. When I try to delete the "@" record, I get another error "invalid 'del_all': Zone record '@' cannot be deleted." I seem to be caught between these two safety checks. What is the proper way to completely remove a reverse DNS zone from FreeIPA (freeipa-server-4.13.1-13.fc44.x86_64)?

2 4

Best way to upgrade FreeIpa version and OS
by Youssef CHTOUROU 26 Jul '26

26 Jul '26

Hello I've 3 FreeIpa Servers (version =4.6.8) runned on Centos 7. I'am looking for upgrade these servers like that : Centos 7 to Rocky 8 FreeIpa server to most recent version possible I would like to see your advice : what is the best / secure way to do this upgrade ? Thanks a lot

2 1

Separate OTP for IdP
by Perry Naseck 26 Jul '26

26 Jul '26

Hi, I have FreeIPA + Keycloak set up in Podman on one machine. Because they are in Podman, I connected Keycloak to FreeIPA via LDAP + Kerberos instead of SSSD. Keycloak has a service account in FreeIPA to do this. Is there a way to enforce Keycloak's LDAP/Kerberos authentication checks to use password only and not password + OTP? Can the user authentication types be configured per-service account or otherwise? I still want password + OTP when a user uses kinit or SSH's into a server. Keycloak's own OTP system makes more sense for users primarily using web applications, so I want to keep those parts separate. Thanks! Perry

2 5

Replication failing to new node
by David Eddleman 24 Jul '26

24 Jul '26

I've setup a FreeIPA server and joined it to AD via one-way trust. I'm attempting to add new master nodes to the server for redundancy and it's failing on the setting up initial replication step: [26/40]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 15 seconds elapsed [ldap://server:389] reports: Update failed! Status: [Error (-2) - LDAP error: Local error - no response received] [error] RuntimeError: Failed to start replication Your system may be partly configured. Run /usr/sbin/ipa-server-install --uninstall to clean up. Failed to start replication The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information [root@server2 ~]# nc -vz server1 389 Ncat: Version 7.92 ( https://nmap.org/ncat ) Ncat: Connected to ip:389. Ncat: 0 bytes sent, 0 bytes received in 0.02 seconds. [root@server2 ~]# nc -vzu server1 389 Ncat: Version 7.92 ( https://nmap.org/ncat ) Ncat: Connected to ip:389. 0▒e▒ ^C What should I be checking on the one master? Services seem to be up and running, I'm not sure what would be 'blocking' the request. They're on the same network segment so no traffic should be getting intercepted between them. No firewall on either, firewalld is dead and masked. What's even more confusing, attempting the replica install again now tells me that there's a replication agreement between these two boxes. Checking the current master I see no other servers in the topology and attempting to run `ipa server-del server2 --force` succeeds but without --force it tells me that no such server exists.

2 3

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users