FreeIPA-users February 2026

freeipa-users@lists.fedorahosted.org

6 participants
4 discussions

Demo freeipa server authentication failure
by Jaquiel Paim 13 Feb '26

13 Feb '26

I'm getting "The password or username you entered is incorrect" using the credentials from the wiki to access: https://ipa.demo1.freeipa.org/ipa/ui/: https://www.freeipa.org/page/Demo I'm getting "401 Unauthorized" consuming https://ipa.demo1.freeipa.org/ipa through https.

2 1

Unable to acquire replica: error: permission denied
by liang fei 13 Feb '26

13 Feb '26

For the previous issue, I was at a loss and took a risky action by executing the command "ipa-replica-manage re-initialize --from xx". However, there are issues with permission authentication between the freeipa4.8 versions. Since freeipa4.8 is currently mainly designed for client-side authentication with the kdc, it is very important and cannot perform the ipa-replica-manage re-initialize operation. What should I do to fix this permission issue? They were previously able to authenticate each other. However, I'm not sure if this was affected by the changes made there. root@fs-hiido-kerberos-server03:/home/liangrui06# ldapsearch -LLL -x -H ldap://localhost:389 -D "cn=Directory Manager" -w $pass -b "cn=replica,cn=dc\3Dxx\2Cdc\3Dcom,cn=mapping tree,cn=config" "(objectClass=nsds5ReplicationAgreement)" cn nsDS5ReplicaHost nsds5replicaLastUpdateStatus dn: cn=fs-hiido-kerberos-server03.hiido.host.xx.com-to-fs-hiido-kerberos -server04.hiido.host.xx.com,cn=replica,cn=dc\3Dxx\2Cdc\3Dcom,cn=m apping tree,cn=config cn: fs-hiido-kerberos-server03.hiido.host.xx.com-to-fs-hiido-kerberos-se rver04.hiido.host.xx.com nsDS5ReplicaHost: fs-hiido-kerberos-server04.hiido.host.xx.com nsds5replicaLastUpdateStatus: Error (1) Can't acquire busy replica (Unable to acquire replica: the replica is currently being updated by another supplier.) dn: cn=meTofs-hiido-kerveros-test08.hiido.host.xx.com,cn=replica,cn=dc\3 Dxx\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-kerveros-test08.hiido.host.xx.com nsDS5ReplicaHost: fs-hiido-kerveros-test08.hiido.host.xx.com nsds5replicaLastUpdateStatus: Error (3) Replication error acquiring replica: U nable to acquire replica: permission denied. The bind dn does not have permis sion to supply replication updates to the replica. Will retry later. (permiss ion denied) root@fs-hiido-kerveros-test08:~# ldapsearch -LLL -x -H ldap://localhost:389 -D "cn=Directory Manager" -w $pass -b "cn=replica,cn=dc\3Dxx\2Cdc\3Dcom,cn=mapping tree,cn=config" "(objectClass=nsds5ReplicationAgreement)" cn nsDS5ReplicaHost nsds5replicaLastUpdateStatus dn: cn=fs-hiido-kerveros-test08.hiido.host.xx.com-to-fs-hiido-ipa-65-155 .hiido.host.xx.com,cn=replica,cn=dc\3Dxx\2Cdc\3Dcom,cn=mapping tr ee,cn=config cn: fs-hiido-kerveros-test08.hiido.host.xx.com-to-fs-hiido-ipa-65-155.hi ido.host.xx.com nsDS5ReplicaHost: fs-hiido-ipa-65-155.hiido.host.xx.com nsds5replicaLastUpdateStatus: Error (0) Replica acquired successfully: Increme ntal update succeeded dn: cn=fs-hiido-kerveros-test08.hiido.host.xx.com-to-fs-hiido-kerberos-2 1-117-149.hiido.host.xx.com,cn=replica,cn=dc\3Dxx\2Cdc\3Dcom,cn=m apping tree,cn=config cn: fs-hiido-kerveros-test08.hiido.host.xx.com-to-fs-hiido-kerberos-21-1 17-149.hiido.host.xx.com nsDS5ReplicaHost: fs-hiido-kerberos-21-117-149.hiido.host.xx.com nsds5replicaLastUpdateStatus: Error (0) Replica acquired successfully: Increme ntal update succeeded dn: cn=meTofs-hiido-kerberos-server02.hiido.host.xx.com,cn=replica,cn=dc \3Dxx\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-kerberos-server02.hiido.host.xx.com nsDS5ReplicaHost: fs-hiido-kerberos-server02.hiido.host.xx.com nsds5replicaLastUpdateStatus: Error (-2) Problem connecting to replica - LDAP error: Local error (connection error) dn: cn=meTofs-hiido-kerberos-server03.hiido.host.xx.com,cn=replica,cn=dc \3Dxx\2Cdc\3Dcom,cn=mapping tree,cn=config cn: meTofs-hiido-kerberos-server03.hiido.host.xx.com nsDS5ReplicaHost: fs-hiido-kerberos-server03.hiido.host.xx.com nsds5replicaLastUpdateStatus: Error (49) Problem connecting to replica - LDAP error: Invalid credentials (connection error) fs-hiido-kerberos-server03 ->meTofs-hiido-kerveros-test08.hiido.host.xx.com What kind of permission is lacking between them? root@fs-hiido-kerveros-test08:/var/log/dirsrv/slapd-YYDEVOPS-COM# tailf errors [29/Jan/2026:15:04:49.513109345 +0800] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=7195 op=90315 replica="dc=xx,dc=com": Unable to acquire replica: error: permission denied [29/Jan/2026:15:04:52.509637825 +0800] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=7195 op=90317 replica="dc=xx,dc=com": Unable to acquire replica: error: permission denied [29/Jan/2026:15:04:55.827408548 +0800] - ERR - NSMMReplicationPlugin - multimaster_extop_StartNSDS50ReplicationRequest - conn=7195 op=90318 replica="dc=xx,dc=com": Unable to acquire replica: error: permission denied

1 3

dhcp using ldap, implementation using freeradius
by Charles Hedrick 12 Feb '26

12 Feb '26

ISC EOL'ed dhcpd a few years ago. We have been using it for DHCP, with LDAP as a data source. The advantage of LDAP is that it's a replicated database. Setting up a replicated SQL is non-trivial. We don't use dynamic DHCP, because wireless is handled by the University for us. So LDAP is a great source. Unfortunately ISC's replacement, KEA, aside from being complex and not entirely open source, doesn't support LDAP. So we're moving to Freeradius, which has a reasonable DHCP implementation. The following has our implementation: https://github.com/clhedrick/kerberos/tree/master/freeradius-dhcp. Getting freeradius to do DHCP against LDAP is quite straightforward, but took a lot of work to figure out, in part because of sketchy documentation. This is for the current production version of freeradius, 3. I'll modify it for version 4 when that is released. It's a few configuration files for freeradius, and dhcp.py, which goes into ipaserver/plugins to enable IPA to manage DHCP information. I should note that while dhcp.py has the whole DHCP schema, it's not clear that anything other than the main config, subnets and hosts actually work, since that's all we use. I need a new objectclass with integer versions of IP addresses for subnets and hosts. Those are set up by the IPA commands and used by the DHCP implementation. The ldif subdirectory has them. The problem is that when a request comes in I need to find the subnet it's part of. LDAP can't compare IP addresses, so I need the integer version to use in a search filter. That's the reason for the new objectclass.

1 0

WEB UI group membership not working Almalinux9/10. Freeipa 4.12.2
by Alex I 11 Feb '26

11 Feb '26

Hello, I'm trying to get groups membership working on freeipa 4.12.2 (tried fresh install on Almalinux 9 and 10). I can add/remove users to/from a group in CLI, but web UI has 'Add' button in group membership pop-up greyed out. I get httpd error 'failed to set perms (3140) on file (/run/ipa/ccaches/admin(a)mydomain.COM-9UR3mc)' and playing with directory ownership gets me nowhere. Any advise? Thanks

3 4

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users February 2026