FreeIPA-users November 2025

freeipa-users@lists.fedorahosted.org

6 participants
6 discussions

missing attribute "ipaOwner" required by object class "ipaSubordinateId"
by Russell Jones 06 Nov '25

06 Nov '25

Hi all, We somewhat recently upgraded our FreeIPA cluster (4 nodes in all-replication setup) from 4.8 to 4.10, and then 4.10 to 4.12 using replication. Stood up two new 4.10 servers, replicated from 4.8. Then stood up two new 4.12 servers, and replicated from 4.10. After that, created two more 4.12 servers and added them into the cluster. All went fairly well, however I just discovered that renaming users fails. When I try to rename a user, I get the following error in server logs: > > [06/Nov/2025:09:09:01.741275830 -0600] - ERR - get_value_from_string - > type does not match: dsEntryDN != dsEntryDN;vucsn-68f12ab70000000f0000 > [06/Nov/2025:09:09:01.932930359 -0600] - ERR - oc_check_required - Entry > "ipauniqueid=05c48cfb-5503-4162-9e14-648d88767356,cn=subids,cn=accounts,dc=us,dc=ep,dc=corp,dc=local" > missing attribute "ipaOwner" required by object class "ipaSubordinateId" > [06/Nov/2025:09:09:01.933838475 -0600] - ERR - referint-plugin - > _update_all_per_mod - Entry > ipauniqueid=05c48cfb-5503-4162-9e14-648d88767356,cn=subids,cn=accounts,dc=us,dc=ep,dc=corp,dc=local > failed (65) > [06/Nov/2025:09:09:01.934989371 -0600] - ERR - oc_check_required - Entry > "ipauniqueid=05c48cfb-5503-4162-9e14-648d88767356,cn=subids,cn=accounts,dc=us,dc=ep,dc=corp,dc=local" > missing attribute "ipaOwner" required by object class "ipaSubordinateId" > [06/Nov/2025:09:09:01.936187948 -0600] - WARN - memberof-plugin - Entry > ipauniqueid=05c48cfb-5503-4162-9e14-648d88767356,cn=subids,cn=accounts,dc=us,dc=ep,dc=corp,dc=local > - schema violation caught - repair operation succeeded > [06/Nov/2025:09:09:01.937103924 -0600] - ERR - oc_check_required - Entry > "ipauniqueid=05c48cfb-5503-4162-9e14-648d88767356,cn=subids,cn=accounts,dc=us,dc=ep,dc=corp,dc=local" > missing attribute "ipaOwner" required by object class "ipaSubordinateId" > [06/Nov/2025:09:09:01.937911140 -0600] - ERR - > slapi_entry_schema_check_ext - Entry > "ipauniqueid=05c48cfb-5503-4162-9e14-648d88767356,cn=subids,cn=accounts,dc=us,dc=ep,dc=corp,dc=local" > single-valued attribute "ipaOwner" has multiple values > [06/Nov/2025:09:09:01.940516533 -0600] - WARN - flush_hash - Upon BETXN > callback failure, entry cache is flushed during 0.000252889 > [06/Nov/2025:09:09:01.941317487 -0600] - WARN - flush_hash - Upon BETXN > callback failure, entry cache is flushed during 0.000233924 I enabled the subid feature a little while back and used the script ( /usr/libexec/ipa/ipa-subids) to generate subid's for everybody without any errors. I am uncertain what has happened or how to proceed from here. Could use some pointers. Thanks!

1 0

Replication error not corrected by reinitializing replication
by David Brown 06 Nov '25

06 Nov '25

Hi, I have a small two node FreeIPA setup. (auth1 & auth2) I noticed today that I was getting a replication error on node 2 (auth2) about missing CSN in the changelog. I reinitialized the two nodes replicating auth1 -> auth2 and this has fixed replication issues in the past, but the error persists. I can create users and delete users from each side of the replication and it appears to be replicating those changes and they seem (non-definitively) to be in sync, but this error concerns me and reinitializing doesn't appear to solve it. Here are the logs. Any help is resolving this would be fantastic as I'm not finding much help via web searches. Thanks, David The sanitized error: Apr 16 10:50:31 auth2 ns-slapd[8419]: [16/Apr/2025:10:50:31.682835677 -0400] - ERR - agmt="cn=caToauth1...." (auth1:389) - clcache_load_buffer - Can't locate CSN 66587eaa000100050000 in the changelog (DB rc=-12797). If replication stops, the consumer may need to be reinitialized. Apr 16 10:50:31 auth2 ns-slapd[8419]: [16/Apr/2025:10:50:31.684721395 -0400] - ERR - NSMMReplicationPlugin - changelog program - repl_plugin_name_cl - agmt="cn=caToauth1...." (auth1:389): CSN 66587eaa000100050000 not found, we aren't as up to date, or we purged Apr 16 10:50:31 auth2 ns-slapd[8419]: [16/Apr/2025:10:50:31.685877312 -0400] - ERR - NSMMReplicationPlugin - send_updates - agmt="cn=caToauth1...." (auth1:389): Data required to update replica has been purged from the changelog. If the error persists the replica must be reinitialized. Santitized re-initialization ipa topologysegment-reinitialize domain auth1....-to-auth2.... --right -------------------------------------------------------------------------------------------- Replication refresh for segment: "auth1....-to-auth2...." requested. -------------------------------------------------------------------------------------------- The sanitized logs of the re-initialization Apr 16 10:45:59 auth2 ns-slapd[8419]: [16/Apr/2025:10:45:59.963872886 -0400] - ERR - ipa-topology-plugin - ipa_topo_be_state_changebackend userRoot is going offline; inactivate plugin Apr 16 10:45:59 auth2 ns-slapd[8419]: [16/Apr/2025:10:45:59.966877380 -0400] - NOTICE - NSMMReplicationPlugin - multisupplier_be_state_change - Replica dc=...,dc=... is going offline; disabling replication Apr 16 10:46:00 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:00.189646600 -0400] - INFO - bdb_instance_start - Import is running with nsslapd-db-private-import-mem on; No other process is allowed to access the database Apr 16 10:46:00 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:00.891598813 -0400] - ERR - agmt="cn=caToauth1...." (auth1:389) - clcache_load_buffer - Can't locate CSN 66587eaa000100050000 in the changelog (DB rc=-12797). If replication stops, the consumer may need to be reinitialized. Apr 16 10:46:00 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:00.893083190 -0400] - ERR - NSMMReplicationPlugin - changelog program - repl_plugin_name_cl - agmt="cn=caToauth1...." (auth1:389): CSN 66587eaa000100050000 not found, we aren't as up to date, or we purged Apr 16 10:46:00 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:00.894538030 -0400] - ERR - NSMMReplicationPlugin - send_updates - agmt="cn=caToauth1...." (auth1:389): Data required to update replica has been purged from the changelog. If the error persists the replica must be reinitialized. Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.403074677 -0400] - INFO - bdb_import_monitor_threads - import userRoot: Workers finished; cleaning up... Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.605238770 -0400] - INFO - bdb_import_monitor_threads - import userRoot: Workers cleaned up. Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.606678188 -0400] - INFO - bdb_public_bdb_import_main - import userRoot: Indexing complete. Post-processing... Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.607860375 -0400] - INFO - bdb_public_bdb_import_main - import userRoot: Generating numsubordinates (this may take several minutes to complete)... Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.618231549 -0400] - INFO - bdb_public_bdb_import_main - import userRoot: Generating numSubordinates complete. Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.620014951 -0400] - INFO - bdb_get_nonleaf_ids - import userRoot: Gathering ancestorid non-leaf IDs... Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.621434375 -0400] - INFO - bdb_get_nonleaf_ids - import userRoot: Finished gathering ancestorid non-leaf IDs. Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.622574267 -0400] - INFO - ldbm_get_nonleaf_ids - import userRoot: Starting sort of ancestorid non-leaf IDs... Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.623757818 -0400] - INFO - ldbm_get_nonleaf_ids - import userRoot: Finished sort of ancestorid non-leaf IDs. Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.626748319 -0400] - INFO - bdb_ancestorid_new_idl_create_index - import userRoot: Creating ancestorid index (new idl)... Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.632623820 -0400] - INFO - bdb_ancestorid_new_idl_create_index - import userRoot: Created ancestorid index (new idl). Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.633896253 -0400] - INFO - bdb_public_bdb_import_main - import userRoot: Flushing caches... Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.635305588 -0400] - INFO - bdb_public_bdb_import_main - import userRoot: Closing files... Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.728196646 -0400] - INFO - bdb_public_bdb_import_main - import userRoot: Import complete. Processed 729 entries in 3 seconds. (243.00 entries/sec) Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.737959417 -0400] - ERR - ipa-topology-plugin - ipa_topo_be_state_change - backend userRoot is coming online; checking domain level and init shared topology Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.744152900 -0400] - NOTICE - NSMMReplicationPlugin - multisupplier_be_state_change - Replica dc=...,dc=... is coming online; enabling replication Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.754743353 -0400] - WARN - NSMMReplicationPlugin - replica_reload_ruv - New data for replica dc=...,dc=... does not match the data in the changelog. Apr 16 10:46:02 auth2 ns-slapd[8419]: Recreating the changelog file. This could affect replication with replica's consumers in which case the consumers should be reinitialized. Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.862749463 -0400] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUVs - Rebuilding the replication changelog RUV, this may take several minutes... Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.864263319 -0400] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUVs - Rebuilding replication changelog RUV complete. Result 0 (Success) Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.872479720 -0400] - ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Password Policy,cn=accounts,dc=...,dc=...--no CoS Templates found, which should be added before the CoS Definition. Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.874025309 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=groups,cn=compat,dc=...,dc=... does not exist Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.875303781 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=computers,cn=compat,dc=...,dc=... does not exist Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.876489711 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=ng,cn=compat,dc=...,dc=... does not exist Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.877770904 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target ou=sudoers,dc=...,dc=... does not exist Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.879231097 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=users,cn=compat,dc=...,dc=... does not exist Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.880458410 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=...,dc=... does not exist Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.881648891 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=...,dc=... does not exist Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.882722133 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=...,dc=... does not exist Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.884124162 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=...,dc=... does not exist Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.885222292 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=...,dc=... does not exist Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.886404863 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=...,dc=... does not exist Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.887615474 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=...,dc=... does not exist Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.889102423 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=...,dc=... does not exist Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.890327963 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=...,dc=... does not exist Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.891412886 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=...,dc=... does not exist Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.892586141 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=vaults,cn=kra,dc=...,dc=... does not exist Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.899706161 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=...,dc=... does not exist Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.901020418 -0400] - WARN - NSACLPlugin - acl_parse - The ACL target cn=casigningcert cert-pki-ca,cn=ca_renewal,cn=ipa,cn=etc,dc=...,dc=... does not exist Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.907037194 -0400] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUVs - Rebuilding the replication changelog RUV, this may take several minutes... Apr 16 10:46:02 auth2 ns-slapd[8419]: [16/Apr/2025:10:46:02.908357262 -0400] - NOTICE - NSMMReplicationPlugin - changelog program - _cl5ConstructRUVs - Rebuilding replication changelog RUV complete. Result 0 (Success)

2 4

Problem with "Login failed due to an unknown reason" / PKINIT OpenSSL error
by Ville Teronen 06 Nov '25

06 Nov '25

Hello, We are currently experiencing strange behavior on FreeIPA system related to PKINIT OpenSSL error when trying to log in through FreeIPA web gui. This started happening as we upgraded our second replica with "dnf ugprade". Freeipa packages in themself haven't been updated. Our setup is basically as follows. ipa.tre-1.web1.fi ipa.tku-2.web1.fi <-- the one not working. GUI throws an error "Login failed due to an unknown reason" httpd error log has the following line after error: [Fri Feb 25 19:32:50.776457 2022] [wsgi:error] [pid 17977:tid 18319] [remote 10.20.11.2:49472] ipapython.ipautil.CalledProcessError: CalledProcessError(Command ['/usr/bin/kinit', '-n', '-c', '/run/ipa/ccaches/armor_17977', '-X', 'X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt', '-X', 'X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem'] returned non-zero exit status 1: 'kinit: Cannot read password while getting initial credentials\\n') Now if I try to run " KRB5_TRACE=/dev/stdout /usr/bin/kinit -n -c /var/run/ipa/ccaches/armor_15581 -X X509_anchors=FILE:/var/kerberos/krb5kdc/kdc.crt -X X509_anchors=FILE:/var/lib/ipa-client/pki/kdc-ca-bundle.pem" I get the following output [19260] 1645812760.557398: Getting initial credentials for WELLKNOWN/ANONYMOUS(a)IPA.WEB1.FI [19260] 1645812760.557400: Sending unauthenticated request [19260] 1645812760.557401: Sending request (186 bytes) to IPA.WEB1.FI [19260] 1645812760.557402: Initiating TCP connection to stream 10.20.13.5:88 [19260] 1645812760.557403: Sending TCP request to stream 10.20.13.5:88 [19260] 1645812760.557404: Received answer (538 bytes) from stream 10.20.13.5:88 [19260] 1645812760.557405: Terminating TCP connection to stream 10.20.13.5:88 [19260] 1645812760.557406: Response was from primary KDC [19260] 1645812760.557407: Received error from KDC: -1765328359/Additional pre-authentication required [19260] 1645812760.557410: Preauthenticating using KDC method data [19260] 1645812760.557411: Processing preauth types: PA-PK-AS-REQ (16), PA-FX-FAST (136), PA-ETYPE-INFO2 (19), PA-PKINIT-KX (147), PA-SPAKE (151), PA-ENC-TIMESTAMP (2), PA_AS_FRESHNESS (150), PA-FX-COOKIE (133) [19260] 1645812760.557412: Selected etype info: etype aes256-cts, salt "IPA.WEB1.FIWELLKNOWNANONYMOUS", params "" [19260] 1645812760.557413: Received cookie: MIT1\x00\x00\x00\x01\x8f\xcb\x99\x9c~\xed!^Qj\xa3\x0a\x82~\xe94\x04\x0ck[j=\x08\xd2\x97j'K2\x8f\xa0\xf6\xc3\x89Z@\x8b]\xc3K\xc2h\xfa\xaek\x11\x91y\xc9\xf0\xadG\x13\x9a\xb2\xb6\x1c\x12\xbfr\x0a'Z\xfe\x12\x81\x1a>2\x8c\x1a\xf2\x96\xdc]&qH\x08\x1f\x0d\xc0a{\xe8\xff\xbbF\x9c\x86`\xd6G\xc4*5\xccL\xc1m\xc0\xa7b\x8b]od\xfa*\xd4.bmB\x9d\x92\xb7\xf9($\xa4D\xea\xcd\xc6\xe3p\xac$\xf4 [19260] 1645812760.557414: Preauth module pkinit (147) (info) returned: 0/Success [19260] 1645812760.557415: PKINIT client received freshness token from KDC [19260] 1645812760.557416: Preauth module pkinit (150) (info) returned: 0/Success [19260] 1645812760.557417: PKINIT loading CA certs and CRLs from FILE [19260] 1645812760.557418: PKINIT loading CA certs and CRLs from FILE [19260] 1645812760.557419: PKINIT loading CA certs and CRLs from FILE [19260] 1645812760.557420: PKINIT client computed kdc-req-body checksum 9/B79768B0DAD630709ABFE35C1E2B6FDAB714913D [19260] 1645812760.557422: PKINIT client making DH request [19260] 1645812760.557423: Preauth module pkinit (16) (real) returned: 0/Success [19260] 1645812760.557424: Produced preauth for next request: PA-FX-COOKIE (133), PA-PK-AS-REQ (16) [19260] 1645812760.557425: Sending request (1674 bytes) to IPA.WEB1.FI [19260] 1645812760.557426: Initiating TCP connection to stream 10.20.13.5:88 [19260] 1645812760.557427: Sending TCP request to stream 10.20.13.5:88 [19260] 1645812760.557428: Received answer (2619 bytes) from stream 10.20.13.5:88 [19260] 1645812760.557429: Terminating TCP connection to stream 10.20.13.5:88 [19260] 1645812760.557430: Response was from primary KDC [19260] 1645812760.557431: Processing preauth types: PA-PK-AS-REP (17), PA-PKINIT-KX (147) [19260] 1645812760.557432: Preauth module pkinit (147) (info) returned: 0/Success [19260] 1645812760.557433: PKINIT OpenSSL error: Failed to verify CMS message [19260] 1645812760.557434: PKINIT OpenSSL error: error:1700006B:CMS routines::content type not enveloped data [19260] 1645812760.557435: PKINIT OpenSSL error: error:03000098:digital envelope routines::invalid digest [19260] 1645812760.557436: PKINIT client could not verify DH reply [19260] 1645812760.557437: Preauth module pkinit (17) (real) returned: -1765328320/Failed to verify CMS message: content type not enveloped data [19260] 1645812760.557438: Produced preauth for next request: (empty) [19260] 1645812760.557439: Getting AS key, salt "IPA.WEB1.FIWELLKNOWNANONYMOUS", params "" Password for WELLKNOWN/ANONYMOUS(a)IPA.WEB1.FI: [19260] 1645812776.928337: AS key obtained from gak_fct: aes256-cts/3840 kinit: Password incorrect while getting initial credentials But this only happens on the "dc2" one. If I would run this on the "dc1" it would work just fine. I have tried running ipa-pkinit-manage disable ipa-pkinit-manage enable to regen the cert but it didn't help. Any suggestions / pointers at why the OpenSSL error on the tku-2 is showing up.

5 9

FreeIP 4.12.5-2-fc42 missing dse.ldif
by Eric Ashley 05 Nov '25

05 Nov '25

Hello people, So on 5 Oct 2025, I attempted to upgrade my FreeIPA server from 4.12.5-2-fc42 to 4.12.5-3-fc42. For some it didn’t save dse.ldif in /etc/dirsrv/slapd-IPA-EXAMPLE-COM/. Looking in that directory, there is a dse.ldif.startOK that is close to the size of many of the dse.ldif.ipa.XXXXXXXXXXXXXXX also saved there. dse.ldif.bak and dse.ldif.modified.out are both empty. Obviously, since dse.ldif is missing, IPA won’t start. Will my copying dse.ldif.startOK to dse.ldif work to get IPA back online so I can then do the upgrade? I think I accidentally rebooted the host machine while the VM was finishing updating or backing up. Thanks, Eric -- Secured with Tuta Mail: https://tuta.com/free-email

2 1

TCP_ERROR/Bad BER Tag Directory Server log spam from same internal client ip
by Joshua Brian 04 Nov '25

04 Nov '25

Migrated from freeipa container rocky-8-4.9.13 to rocky-9-4.12.2 using Red Hat documentation: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html-si… We didn't have this issue in 4.9.13 but now I'm seeing this error at least every minute. The client ip seems to be coming from within the pod/kubernetes and isn't pingable or resolvable. I can't find what that client ip is. Does anyone have any ideas? We also aren't using large host groups like this thread mentioned: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahost… /var/log/dirsrv/slapd-/security: { "date": "[03\/Nov\/2025:18:58:05.994695464 +0000] ", "utc_time": "1762196285.994695464", "event": "TCP_ERROR", "client_ip": "135.x.x.x", "server_ip": "192.x.x.x", "ldap_version": 3, "conn_id": 408840, "msg": "Bad Ber Tag or uncleanly closed connection - B1" } { "date": "[03\/Nov\/2025:18:59:05.994629117 +0000] ", "utc_time": "1762196345.994629117", "event": "TCP_ERROR", "client_ip": "135.x.x.x", "server_ip": "192.x.x.x", "ldap_version": 3, "conn_id": 408914, "msg": "Bad Ber Tag or uncleanly closed connection - B1" } { "date": "[03\/Nov\/2025:18:59:52.637722671 +0000] ", "utc_time": "1762196392.637722671", "event": "TCP_ERROR", "client_ip": "135.x.x.x", "server_ip": "192.x.x.x", "ldap_version": 3, "conn_id": 408968, "msg": "Bad Ber Tag or uncleanly closed connection - B1" } { "date": "[03\/Nov\/2025:19:00:05.995032019 +0000] ", "utc_time": "1762196405.995032019", "event": "TCP_ERROR", "client_ip": "135.x.x.x", "server_ip": "192.x.x.x", "ldap_version": 3, "conn_id": 408983, "msg": "Bad Ber Tag or uncleanly closed connection - B1" } { "date": "[03\/Nov\/2025:19:01:05.994405846 +0000] ", "utc_time": "1762196465.994405846", "event": "TCP_ERROR", "client_ip": "135.x.x.x", "server_ip": "192.x.x.x", "ldap_version": 3, "conn_id": 409068, "msg": "Bad Ber Tag or uncleanly closed connection - B1" } { "date": "[03\/Nov\/2025:19:02:05.995037939 +0000] ", "utc_time": "1762196525.995037939", "event": "TCP_ERROR", "client_ip": "135.x.x.x", "server_ip": "192.x.x.x", "ldap_version": 3, "conn_id": 409160, "msg": "Bad Ber Tag or uncleanly closed connection - B1" } { "date": "[03\/Nov\/2025:19:03:05.994388392 +0000] ", "utc_time": "1762196585.994388392", "event": "TCP_ERROR", "client_ip": "135.x.x.x", "server_ip": "192.x.x.x", "ldap_version": 3, "conn_id": 409229, "msg": "Bad Ber Tag or uncleanly closed connection - B1" } { "date": "[03\/Nov\/2025:19:03:39.730243171 +0000] ", "utc_time": "1762196619.730243171", "event": "TCP_ERROR", "client_ip": "135.x.x.x", "server_ip": "192.x.x.x", "ldap_version": 3, "conn_id": 409275, "msg": "Bad Ber Tag or uncleanly closed connection - B1" } Example connection logged in access log from security log. /var/log/dirsrv/slapd-/access: [03/Nov/2025:18:58:05.993069510 +0000] conn=408840 fd=376 slot=376 connection from 135.x.x.x to 192.x.x.x [03/Nov/2025:18:58:05.994691456 +0000] conn=408840 op=-1 fd=376 Disconnect - Bad Ber Tag or uncleanly closed connection - B1

2 1

Can't start and can't convert ds database
by Ian Kumlien 01 Nov '25

01 Nov '25

Hi, After a recent update on fedora 42 i couldn't start freeipa anymore, this is the second host this has happened on. I reinstalled the other one, but this is the last host with kra enabled, which can cause some issues... I dunno if there is someway to just disable kra, Either way, when dirsrv starts it complained and pointed me to dsctl, but it kept failing so: dsctl -v VIRT-DEMIUS-NET dblib bdb2mdb pointed me at the command that fails which is: /usr/bin/ns-slapd db2ldif -D /etc/dirsrv/slapd-VIRT-DEMIUS-NET -n changelog -r -a /var/lib/dirsrv/slapd-VIRT-DEMIUS-NET/ldif/__dblib-changelog.ldif [01/Nov/2025:13:00:08.091958050 +0100] - WARN - config_set_ldapi_root_dn - The "nsslapd-ldapimaprootdn" setting is obsolete and kept for compatibility reasons. For LDAPI configuration, "nsslapd-rootdn" is used instead. Segmentation fault (core dumped) /usr/bin/ns-slapd db2ldif -D /etc/dirsrv/slapd-VIRT-DEMIUS-NET -n changelog -r -a /var/lib/dirsrv/slapd-VIRT-DEMIUS-NET/ldif/__dblib-changelog.ldif Now these machines has been running for a long time, and been updated trough several iterations of fedora... one issue i had on the machine that i reinstalled was that nss.conf was there =) (Reinstated by ipa-server-install --uninstall ?? )

2 1

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users November 2025