FreeIPA-users November 2025

freeipa-users@lists.fedorahosted.org

15 participants
20 discussions

HTTP returns non-2xx status code
by Tania Hagan 26 Jan '26

26 Jan '26

Hi freeipa-users, We're currently using Freeipa version 4.11.0 on Rocky 9.4 with Apache/2.4.57 and every so often our HTTP fails with our monitoring returning non-2xx status code. Looking at the error log for httpd I see: [mpm_event:error] [pid 1800:tid 1800] AH03490: scoreboard is full, not at MaxRequestWorkers.Increase ServerLimit. Researching this error, it appears to recommend adding to the httpd configuration https://forum.directadmin.com/threads/ah03490-scoreboard-is-full-note-at-ma…. Has anyone had to do this or can recommend a "freeipa" way to resolve this? (Reluctant to mess around with the httpd configuration as unsure on the effects of the client connections with freeipa) Many Thanks, Tania

3 6

DNSSEC - File.cpp(94): Could not open the file
by lejeczek 18 Dec '25

18 Dec '25

Hi guys When I sign a zone I get lots of: ... File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/26365760-a70d-19be-2db1-a80adc796477.object File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/9776a26e-2ad9-1b46-b65c-11265eee7fbd.object File.cpp(94): Could not open the file (Permission denied): /var/lib/ipa/dnssec/tokens/4ee2f633-3b2a-ef03-6909-473386d17234/9776a26e-2ad9-1b46-b65c-11265eee7fbd.object zone private.road/IN (signed): sending notifies (serial 1642004083) client @0x7f8f7c1948b8 10.3.1.99#39887: received notify for zone 'private.road' Are those a reason to worry & investigate? If not then what do they translate to? many thanks, L

3 5

last login info
by Dmitry Krasov 12 Dec '25

12 Dec '25

Hello. How to get last freeipa user's login info? There is no this info in web ui or from user-find command

4 12

dns response policy - something IPA can do?
by lejeczek 01 Dec '25

01 Dec '25

Hi guys. As per the subject - ideally with IPA's toolkit, within IPA, as opposed to tinkering with *bind* directly. thanks, L.

3 3

dirsrv failure to startup
by Peter Larsen 01 Dec '25

01 Dec '25

After having seen a lot of SERVFAIL for named-pkcs11 resolutions (resulting in a very slow name resolution) I choose to restart all services to start debugging from a clean state. Well, careful what you wish for. Dirsrv no longer starts, and the errors I see begin with: INFO - bdb_start - Resizing db cache size: 161433681 -> 161433517 ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher AES ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. ERR - attrcrypt_unwrap_key - Failed to unwrap key for cipher 3DES ERR - attrcrypt_cipher_init - Symmetric key failed to unwrap with the private key; Cert might have been renewed since the key is wrapped. To recover the encrypted contents, keep the wrapped symmetric key value. ERR - attrcrypt_init - All prepared ciphers are not available. Please disable attribute encryption. ERR - memberof-plugin - memberof_config - Error 53: The ipaOwner configuration attribute must be set to an attribute defined to use either the Distinguished Name or Name and Optional UID syntax. (illegal value: memberOfGroupAttr) ERR - memberof-plugin - memberof_postop_start - Configuration failed (Server is unwilling to perform) ERR - plugin_dependency_startall - Failed to start betxnpostoperation plugin MemberOf Plugin ERR - schema-compat-plugin - scheduled schema-compat-plugin tree scan in about 5 seconds after the server startup! ====== The last update was to enable dnssec on the server. That seems to have worked fine, ods have been creating/updating keys as expected. I then see a lot of WARN about key dn's missing: WARN - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=domain,dc=tld So reading/consistency of the opened files is definitely not working. This is followed by ERR - NSACLPlugin - __aclp__init_targetattr - targetattr "ipapwddictcheck" does not exist in schema. Please add attributeTypes "ipapwddictcheck" to schema if necessary. I feel like the best way forward is to grab a copy of a replica and start from there, Before I do that, I would love to understand what may be missing, because of it cannot "decrypt" the ldap, I'm not sure what a new copy requiring the same encryption would do? This is the version running. Name : ipa-server Version : 4.9.13 Release : 18.module+el8.10.0+23403+cc1f9b40 // Peter

2 2

Failed DNSSEC master - created new replica in cluster, how to promote to DNSSEC master?
by Peter Larsen 30 Nov '25

30 Nov '25

See $SUBJECT. When running "ipa-dns-instal --dnssec-master" it failures saying "DNSSEC key master(s): <ipa server> Only one DNSSEC key master is supported ..." The problem is that the server marked as DNSSEC master is failed, and (see other post) will not start dirsrv with what looks like a corruption in some files. I tried for quite a while to find a solution to recover the old replica, but I gave up. It's still "as is" but I hope to transfer it's responsibilities including DNSSEC to a new server before removing the old failed one. Hopefully someone has a link that documents this. All I find seems to insist I need to create a new DNSSEC master node first. I guess I can do that only if I totally remove the old failed server first. The key is that I cannot run any ipa-dns-commands on it, nor ipa-server commands - nothing is running, dirsrv fails starting right after the daemon is loaded but it then goes into a loop of not being able to find key DNs like hosts, users etc. Thanks!

1 0

ipa-ca-install - second password?
by ether bunny 26 Nov '25

26 Nov '25

When I run this command from a replica Im asked for two passwords. The first appears to be the admin account on the primary host but I don't know what the second one is or how to set it. # ipa-ca-install Directory Manager (existing master) password: <-- I know this one Running ipa-certupdate...done Run connection check to master host/replica.domain.edu@DOMAIN.EDU@primary.domain.edu's password: <--- I don't know this one I went to the host entry for the replica and tried to set a OTP but was unable. "IPA Error 3009: ValidationError" Not sure where to look for other errors.

3 5

Adding a replica - problems with kinit, sudo, etc
by ether bunny 21 Nov '25

21 Nov '25

Setup: primary host: centos7 - ipa v 4.6.8 Attempted replica: rocky9 - ipa 4.12.2 Ultimate goal is to ditch the centos 7 host. Replica installation finished without any (apparent) errors. Subsequent attempts to kinit gave me the "kinit: Generic error (see e-text) while getting initial credentials". (details are summarized here: https://serverfault.com/questions/1196002/freeipa-replica-issues-cant-kinit… ) It seems that Im lacking proper SID assignments owing to the old version of the primary host. Unfortunately when I tried to fix this (per https://enotty.pipebreaker.pl/posts/2024/01/woes-with-freeipa-and-sids/) [root@freeipa ~]# ipa config-mod --enable-sid --add-sids Usage: ipa [global-options] config-mod [options] ipa: error: no such option: --enable-sid So Im guessing I need to upgrade the primary host somehow.. But all the centos7 repos are shut down. One thing I noticed: # ipa user-show admin --all | grep ipantsecurityidentifier This does show the -500 - and the admin group has the -512 as well. It doesn't appear that I have the ipa-print-pac command available.

2 1

FreeIP 4.12.5-2-fc42 missing dse.ldif
by Eric Ashley 20 Nov '25

20 Nov '25

Hello people, So on 5 Oct 2025, I attempted to upgrade my FreeIPA server from 4.12.5-2-fc42 to 4.12.5-3-fc42. For some it didn’t save dse.ldif in /etc/dirsrv/slapd-IPA-EXAMPLE-COM/. Looking in that directory, there is a dse.ldif.startOK that is close to the size of many of the dse.ldif.ipa.XXXXXXXXXXXXXXX also saved there. dse.ldif.bak and dse.ldif.modified.out are both empty. Obviously, since dse.ldif is missing, IPA won’t start. Will my copying dse.ldif.startOK to dse.ldif work to get IPA back online so I can then do the upgrade? I think I accidentally rebooted the host machine while the VM was finishing updating or backing up. Thanks, Eric -- Secured with Tuta Mail: https://tuta.com/free-email

2 4

cannot resolve a specific FQDN?
by lejeczek 18 Nov '25

18 Nov '25

HI guys. This is DNS related but I'd say - no lack of experienced users here. My IPA's dns cannot, do not want to, resolve a specific few (perhaps many more, how knows) public domains. Popular, well-known but also my IPS's dnses, do resolve these same domains, immediately, no problems. So I gave those couple of dnses I've tired, as *forwarders* to IPA but, that does not help. query_errors.log says: ... query failed (timed out) ... same as when there were no forwarders at all. dig shows: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 2088 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 as opposed to when pointed directly at a forwarder: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61791 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 All this is quite weird to me but hey ! ain't an expert. What is (not)happening here ? any/all thoughts are much appreciated. many thanks, L.

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2025