FreeIPA-users January 2026

freeipa-users@lists.fedorahosted.org

9 participants
6 discussions

[SSSD] Announcing SSSD 2.9.8
by Pavel Březina 21 Jan '26

21 Jan '26

# SSSD 2.9.8 The SSSD team is announcing the release of version 2.9.8 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.9.8 See the full release notes at: https://sssd.io/release-notes/sssd-2.9.8.html While we plan to maintain this branch providing critical bug fixes upstream, we don't commit to regular releases off this branch going forward. We recommend switching to the latest upstream release 2.12.0. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users # SSSD 2.9.8 Release Notes ## Highlights ### General information * After startup SSSD already creates a Kerberos configuration snippet typically in /var/lib/sss/pubconf/krb5.include.d/localauth_plugin if the AD or IPA providers are used. This enables SSSD's localauth plugin. Starting with this release the an2ln plugin is disabled in the configuration snippet as well. If this file or its content are included in the Kerberos configuration it will fix CVE-2025-11561. ### Configuration changes * An option `ipa_enable_dns_sites`, that never worked due to missing server side implementation, was removed. * The default value of session_provider option was changed to none (i.e. disabled) no matter what id_provider used. Previously session_provider was enabled by default for id_provider = ipa case. The primary tool it was intended to support, “Fleet Commander,” has become obsolete. * The option `ipa_subid_ranges_search_base` was deprecated in favor of `ldap_subid_ranges_search_base`.

1 0

Re: IPA users/groups are gone after a second reboot
by Sven Jansen 20 Jan '26

20 Jan '26

Hi, I see the same problem on my IPA installations for around one or two weeks now. All affected machines run FreeIPA 4.9.13-20. * one machine is a RHEL 8.10 standalone deployment * two machines are AlmaLinux 8.10 sync between each other * All instances have the full capability, DNS, Certificate Authority and acme. These installations are not related and in different companys. On the first RHEL machine, users are listed, groups are not, some other object types are missing, you can find objects by searching for the name, same with ipa find-user. Fresh created users/group/hosts work fine and show up in Web interface and ipa find-user. On the second pair (running AlmaLinux), its a bit different, no users, groups, hosts, sudo rules etc. are shown, only fresh created objects show up by using the Web interface or using ipa command. DNS is a bit different, on IPA1, all DNS zones are visible, on IPA2, no zones are visible, except i create a new zone. Luckly i still can see all zones on IPA1. Searching for DNS zones on IPA2 does not work, but i can reach the zone by changing the url to “/ipa/ui/#/e/dnszone/records/mydomain.com” on IPA2, so they are there and accessible. I tried to edit existing objects to see if they pop up, but no luck. I ran ipa-server-upgrade to see if some migration is missing, but it finish without issue and the problem persist. No issues with DNS lookups, getting certs or provide authentication, just searching/showing objects is broken I have no clue how to fix that, i can see no “useful” information in my slapd logs or i dont know what to lock for.

4 7

Freeipa schema issue and replication
by M D 20 Jan '26

20 Jan '26

I inherited a freeipa cluster, hand cranked and all of that. For some reason, the wrong schema was replicated from a bad server that I was trying to add to the cluster using ipa-replica-install to a working one. 10% of ipa servers are left and I am afraid I may lose them. Before this disaster, a coworker was upgrading freeipa servers using with --skip-version-check. Some servers have 4.9.13-12.module+el8, others have 4.9.13-18.module+el8. the following is a snippet of multiple error lines ERR - NSACLPlugin - __aclp__init_targetattr - targetattr > “ipauserdefaultsubordinateid” does not exist in schema. Please add > attributeTypes “ipauserdefaultsubordinateid” to schema if necessary. > ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE > ERR(rv=-5): (targetattr = "cn > ERR - NSACLPlugin - __aclinit_handler - This ((targetattr = “cn || > createtimestamp || entryusn || ipacertificatesubjectbase || ipaconfigstring > || ipacustomfields || ipadefaultemaildomain || ipadefaultloginshell || > ipadefaultprimarygroup || ipadomainresolutionorder || ipagroupobjectclasses > || ipagroupsearchfields || ipahomesrootdir || ipakrbauthzdata || > ipamaxhostnamelength || ipamaxusernamelength || ipamigrationenabled || > ipapwdexpadvnotify || ipasearchrecordslimit || ipasearchtimelimit || > ipaselinuxusermapdefault || ipaselinuxusermaporder || ipauserauthtype || > ipauserdefaultsubordinateid || ipauserobjectclasses || ipausersearchfields > || modifytimestamp || objectclass”)(targetfilter = > “(objectclass=ipaguiconfig)”)(version 3.0;acl “permission:System: Read > Global Configuration”;allow (compare,read,search) userdn = “ldap:///all”;)) > ACL will not be considered for evaluation because of syntax errors. > ERR - NSACLPlugin - __aclp__init_targetattr - targetattr > “ipaautoprivategroups” does not exist in schema. Please add attributeTypes > “ipaautoprivategroups” to schema if necessary. > ERR - NSACLPlugin - acllist_insert_aci_needsLock_ext - ACL PARSE > ERR(rv=-5): (targetattr = "cn > ERR - NSACLPlugin - __aclinit_handler - This ((targetattr = “cn || > createtimestamp || entryusn || ipaautoprivategroups || ipabaseid || > ipabaserid || ipaidrangesize || ipanttrusteddomainsid || iparangetype || > ipasecondarybaserid || modifytimestamp || objectclass”)(targetfilter = > “(objectclass=ipaidrange)”)(version 3.0;acl “permission:System: Read ID > Ranges”;allow (compare,read,search) userdn = “ldap:///all”;)) ACL will not > be considered for evaluation because of syntax errors. > WARN - NSACLPlugin - acl_parse - The ACL target cn=automember rebuild > membership,cn=tasks,cn=config does not exist > INFO - slapi_vattrspi_regattr - Because krbPwdPolicyReference is a new > registered virtual attribute , nsslapd-ignore-virtual-attrs was set to ‘off’ > ERR - cos-plugin - cos_dn_defs_cb - Skipping CoS Definition cn=Password > Policy,cn=accounts,dc=example,dc=com–no CoS Templates found, which should > be added before the CoS Definition. I am not sure where to begin, I am kind of lost. Help is appreciated.

1 0

FreeIPA 4.13.1
by Antonio Torres 16 Jan '26

16 Jan '26

The FreeIPA team would like to announce the FreeIPA 4.13.1 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. Full release notes are available at: https://www.freeipa.org/release-notes/4-13-1.html

1 0

[SSSD] Announcing SSSD 2.12.0
by Pavel Březina 15 Jan '26

15 Jan '26

# SSSD 2.12.0 The SSSD team is announcing the release of version 2.12.0 of the System Security Services Daemon. The tarball can be downloaded from: https://github.com/SSSD/sssd/releases/tag/2.12.0 See the full release notes at: https://sssd.io/release-notes/sssd-2.12.0.html RPM packages will be made available for Fedora shortly. ## Feedback Please provide comments, bugs and other feedback via the sssd-devel or sssd-users mailing lists: https://lists.fedorahosted.org/mailman/listinfo/sssd-devel https://lists.fedorahosted.org/mailman/listinfo/sssd-users # SSSD 2.12.0 Release Notes ## Highlights ### General information * After startup SSSD already creates a Kerberos configuration snippet typically in `/var/lib/sss/pubconf/krb5.include.d/localauth_plugin` if the AD or IPA providers are used. This enables SSSD's localauth plugin. Starting with this release the an2ln plugin is disabled in the configuration snippet as well. If this file or its content are included in the Kerberos configuration it will fix CVE-2025-11561. * Previously deprecated `--with-extended-enumeration-support` `./configure` option was removed. * SSSD now allows using machine credentials from a trusted AD domain or Kerberos realm if no suitable domain-local credentials are available. ### New features * SSSD now supports authentication mechanism selection through PAM using a JSON-based protocol. This feature enables passwordless authentication mechanisms in GUI login environments that support the protocol. Feature will be supported by GNOME Display Manager (GDM) starting with GNOME 50. While currently optimized for GNOME, the JSON protocol design allows for future support in other display managers. authselect is the recommended approach and will handle the necessary PAM stack modifications automatically starting with version 1.7 through the new option `with-switchable-auth` which provides a new PAM service called `switchable-auth`. Manual PAM configuration is also possible. For more technical details and implementation specifications, see the design documentation: https://sssd.io/design-pages/passwordless_gdm.html ### Packaging changes * This update makes it possible to not grant CAP_SETUID and CAP_SETGID to `krb5_child` binary in a situation where it is not required to store acquired TGT after user authentication. Taking into account that it is already possible to avoid using CAP_DAC_READ_SEARCH if keytab is readable by SSSD service user, and usage of 'selinux_child' isn't always required, this allows to build a setup with completely privilege-less SSSD to serve certain use cases. In particular, this might be used to build a container running SSSD on OCP with a restricted profile. * A new configure option `--with-ldb-modules-path=PATH` option to specify LDB modules path at build time. * `--with-allow-remote-domain-local-groups` `./configure` option was removed. ### Configuration changes * An option `ipa_enable_dns_sites`, that never worked due to missing server side implementation, was removed. * A new option `pam_json_services` is now available to enable JSON protocol to communicate the available authentication mechanisms. * The default value of `session_provider` option was changed to `none` (i.e. disabled) no matter what `id_provider` used. Previously `session_provider` was enabled by default for `id_provider = ipa` case. The primary tool it was intended to support, "Fleet Commander," has become obsolete. * The option `ipa_subid_ranges_search_base` was deprecated in favor of `ldap_subid_ranges_search_base`. * Support of previously deprecated `ad_allow_remote_domain_local_groups` config option was removed completely. * `ipa_dyndns_update`, `ipa_dyndns_ttl`, and `ipa_dyndns_iface` legacy options were removed. * A new option, `dyndns_address`, has been introduced to specify network addresses that are allowed or excluded from dynamic DNS updates. The `dyndns_iface` option has been extended to support the exclusion of network interfaces.

1 0

DSSKEWLE0001 -- Time skew over 6 hours
by Tim Henderson 06 Jan '26

06 Jan '26

I've had this warning for a long time now, but finally writing the mailing list for help. ``` { "items" : [ "Replication", "dc=local,dc=dom,dc=net", "Time Skew", "Skew: 7 hours, 57 minutes, 20 seconds" ], "key" : "DSSKEWLE0001", "msg" : "The time skew is over 6 hours. If this time skew continues to increase\nto 24 hours then replication can potentially stop working. Please continue to\nmonitor the time skew offsets for increasing values." }, ``` Is there some way to fix this, and/or reset this? There is very little clock skew between my 3 IPA servers. A few seconds at most, not hours. So I would think somewhere in the IPA backend there is a reset command, or something to say "check this again"? ``` freeipa2.local.dom.net: Tue Jan 6 01:12:13 EST 2026 freeipa1.local.dom.net: Tue Jan 6 01:12:29 EST 2026 freeipa1-den.local.dom.net: Tue Jan 6 01:12:33 EST 2026 ```

3 3

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users January 2026