FreeIPA-users May 2025

freeipa-users@lists.fedorahosted.org

8 participants
5 discussions

Activating schema compat plugin remotely
by Adam Bishop 10 May '25

10 May '25

Is there any way that the schema compat plugin can be enabled remotely via LDAP or the HTTP API? I'm running FreeIPA under Gitlab CI as a service container, and due to limitations arbitrary commands can't be run on the container unless they're exposed in the Dockerfile. I'd like to avoid modifying the container with changes just needed for CI, as that then means that we're not testing the same code as we do in production. Calling ipa-compat-manage fails ("IPA is not configured on this system.") even though it accepts parameters and credentials to target a remote server. I can't enrol a client as ipa-client-install doesn't work without systemd/dbus. Adam

1 3

Cant install with external-ca
by Entrepreneur AJ 10 May '25

10 May '25

I have created an internal CA with openssl for my company with a sub ca for signing certain services such as FreeIPA root CA's problem I am having is I have signed the csr and uploaded it back to the freeipa server but when I try to run the second part of the install it errors out. The following is the command used to run the second part of the install: ipa-server-install --external-cert-file=/root/ipa.crt --external-cert-file=/root/internal-ca.cert.pem this is the output: The log file for this installation can be found in /var/log/ipaserver-install.log Directory Manager password: ============================================================================== This program will set up the IPA Server. Version 4.12.2 This includes: * Configure a stand-alone CA (dogtag) for certificate management * Configure the NTP client (chronyd) * Create and configure an instance of Directory Server * Create and configure a Kerberos Key Distribution Center (KDC) * Configure Apache (httpd) * Configure SID generation * Configure the KDC to enable PKINIT IPA CA certificate with subject 'CN=Certificate Authority,O=EAJ Global,OU=UK Internal Certificate Authority,C=GB' was not found in /root/ipa.crt,/root/internal-ca.cert.pem. The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information I used openssl to verify the certificate subject matches: root@ipa1:~# openssl x509 -in /root/ipa.crt -noout -subject subject=C=GB, O=EAJ Global, OU=UK Internal Certificate Authority, CN=Certificate Authority Only difference i see is the order of the subject line. But the subject itself is still valid. I am running Fedora 42 with the latest version in the repos installed. Any help would be appreciated.

2 3

FreeIPA failed after upgrading to fedora 42
by Ian Kumlien 09 May '25

09 May '25

Hi, I have two freeipa servers that failed after the upgrade. On one, i managed to fix it with ipa-cert-fix since they had expired again, but i'm now left with: ipa-backup Preparing backup on freeipa1.... Error: Local roles CA, DNS, DNSKeySync do not match globally used roles CA, DNS, DNSKeySync, KRA. A backup done on this host would not be complete enough to restore a fully functional, identical cluster. The ipa-backup command failed. See /var/log/ipabackup.log for more information And on the other pki-tomcat doesn't start without ca_signing.csr which it never had according to backups... Any clues?

3 10

ad login after reinstallation
by Remo Schmid 09 May '25

09 May '25

i have a construct with two freeipa servers and a samba ad that trusts each other. now i have rebuilt a freeipa, since then i have problems with the authentication. logging in via ssh on server works (via ssh key), but doing sudo on the server with the ad user does not work. according to logfiles the password of the ad user is checked correctly and there i also see different logs if the password is correct or wrong. Kerberos says the password is checked successfully. however, it does not work afterwards. in the krbt5_child.log I see the following error. ==> [krb5_child[33538]] [get_and_save_tgt] (0x0020): [RID#45] 2395: [-1765328353][Decrypt integrity check failed] the trust position looks good from samba ad as well as from the ipa side. are there any who have had similar problems after reinstalling? any ideas what else I should check?

2 1

Impossible to install a KRA replicate with FreeIPA version 4.12.2-1 (RHEL9)
by LHEUREUX Bernard 05 May '25

05 May '25

Hello all, I desperately try to migrate my infrastructure containing 3 FreeIPA Servers 4.9.13-16 running under RHEL8 without any problems, for this I completely uninstall server3, I remove it from the FreeIPA infrastructure, and then install a fresh new RHEL9 FreeIPA Machine with version 4.12.2-1, the "ipa-replica-install --setup-ca --setup-dns --auto-forwarders --auto-reverse" works perfectly well, then I try the ipa-replica-install, but constantly get an error... The /var/log/ipaserver-kra-install.log gives: "Error" : "Unable to add KRA connector for https://server3.domain.local:8443: KRA connector already exists" I found a similar problem in that page, https://forums.rockylinux.org/t/freeipa-kra-install-fails-on-rocky-9-replic… I tried, but that didn't solve the issue... Could you help me finding a solution ? [https://www.win.be/images/fr/logowin.jpg] Bernard LHEUREUX Linux & System Engineer Mob. +32 475 530 311 <tel:+32475530311> win.be <https://www.win.be/> [facebook]<http://www.youtube.com/channel/UC-rXMcRf_tMl5K4EBHKWpGg> [linkedin] <https://www.linkedin.com/company/win-s-a-/> [twitter] <https://twitter.com/win_ICTpartner> ________________________________ 1/Conform?ment ? notre certification ISO 27001, ce message et toute pi?ce jointe sont la propri?t? exclusive de Win. L'information contenue dans cet e- mail peut s'av?rer confidentielle et d?s lors prot?g?e de toute divulgation. Si vous avez re?u cette communication par erreur, veuillez nous en informer imm?diatement en r?pondant ? ce message et en le supprimant de votre ordinateur, sans le copier ni le divulguer. 2/L'acceptation de toute offre commerciale (quel qu'en soit le support) emporte l'adh?sion aux descriptifs (notamment techniques) inh?rents aux solutions offertes, ainsi qu'aux conditions commerciales g?n?rales de Win, consultables via https://www.win.be/cgv DISCLAIMER : https://www.win.be/fr-win/disclaimer.htm

3 4

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users May 2025