FreeIPA-users March 2026

freeipa-users@lists.fedorahosted.org

23 participants
27 discussions

EL9 IPA servers hanging on shutdown
by Orion Poplawski 25 Aug '26

25 Aug '26

We're seeing our EL9 IPA server VMs get stuck often at: A stop job is running for Identity, Policy, Audit Is anyone else seeing this? How can I avoid it? -- Orion Poplawski he/him/his - surely the least important thing about me IT Systems Manager 720-772-5637 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

2 2

Best way to upgrade FreeIpa version and OS
by Youssef CHTOUROU 26 Jul '26

26 Jul '26

Hello I've 3 FreeIpa Servers (version =4.6.8) runned on Centos 7. I'am looking for upgrade these servers like that : Centos 7 to Rocky 8 FreeIpa server to most recent version possible I would like to see your advice : what is the best / secure way to do this upgrade ? Thanks a lot

2 1

configure ipa-healthcheck?
by lejeczek 08 May '26

08 May '26

I see there is a config file and I searched, but failed to find an info on how to, ideally permanently, tell ipa-healthcheck what is the threshold for filesystem - do you now? thanks, L.

4 3

Authenticate users with yubikeys without importing the certificate in IPA does not work.
by Theodor Vallier 23 Apr '26

23 Apr '26

Hello, I'm trying to allow authentication using Yubikeys on clients without importing user's certificates in idM. I use an external PKI that signs everything, so I have the root CA and one sub CA named piv that signs users' csr (that are stored in yubikeys). On the server, the output of ipa-advise config-server-for-smart-card-auth is executed and the output of ipa-advise config-client-for-smart-card-auth is also executed on the client. I added both the certificate mapping rule and the certificate mapping data (Issuer and subject) according to red hat documentation. Steps to Reproduce: In an internet forbidden environment, using at least three VMs on RHEL9. One for IPA, one as a workstation and one that will be the DHCP, DNS and NTP server. Once the DNS and DHCP are configured, I generated a root CA and two sub CAs, one for signing users csr (piv) and one for signing everything else (like ipa). Once ipa is installed with an external ca, I executed the output of ipa-advise config-server-for-smart-card-auth to load and configure ipa for smartcard. Then I added the Certificate Identity Mapping Rule: Mapping rule: (ipacertmapdata=X509:<I\>{issuer\_dn!nss\_x500}<S>{subject_dn!nss_x500}) Matching rule: <ISSUER>CN=piv,C=FR Once the client is registered in ipa, I executed the output of ipa-advise config-client-for-smart-card-auth to load and configure the client for smartcard. Then, I registered a new user, with pkinit enable and I created a Certificate mapping data for him with the good Subject and the same Issuer as the Certificate Identity Mapping Rule. Finally, I set up the yubikey for the corresponding user using the PKI and signed his certificate with the piv CA. Actual behavior: If the user certificate is not present in ipa, I'm prompted to enter the PIN CODE (the Yubikey is recognized and the user is automatically selected), but then I have the error "Sorry, smart card authentication didn't work, please try again". On ipa server, if I use the command ipa certmap-match <user-certificate>, no users are found. Furthermore, in sssd I can see that the server is trying to find a user with the certificate stored on the yubikey instead of trying to check if the certificate is valid and signed by the piv sub CA. Expected behavior: I would expect to be logged in. Version/Release/Distribution: ipa-server-4.10.1-9.el9_2.x86_64 ipa-client-4.10.1-9.el9_2.x86_64 389-ds-base-2.2.4-5.el9_2.x86_64 krb5-server-1.20.1-9.el9_2.x86_64 sssd-2.8.2-3.el9_2.x86_64 Additional info: I can provide more logs if necessary but don't know which ones you could want. Thanks Whidix

3 4

Webservices failing when run behind Caddy v2.11 Reverse Proxy
by Daniel Paetzold 08 Apr '26

08 Apr '26

When Caddy v2.10.X is a reverse Proxy for FreeIPA, then after upgrade to V2.11.? the Webservices will stop working, leading to inifite Redirect 301/307 loops when connecting to https://.../ipa/ui That will cause Browsers to complain about e.g. "Error_Too_Many_Redirects" without any other output. Other Services like IPA- Vaults won't work any more. The Error seems to be in the Apache rewrite- rule as all connections to "https://.../ipa/ui" will get redirected to non-ssl "http://.../ipa/ui" via 301 which again will be redirected to "https://.../ipa/ui" via 307, which is a loop. According to https://github.com/alexandzors/caddy/releases The Problem may be related to: "Reverse proxy now automatically rewrites the Host header to the address of the upstream when the upstream is HTTPS (#7454)" Deactivating Freeipas Apache rewrite Rules for Port 443 as described at https://www.adelton.com/freeipa/freeipa-behind-ssl-proxy does not solve the Problem. Has anyone already had that Problem and an idea how it could be fixed to make the rules work with caddys new behaviour?

1 1

Authentication failure using FreeIPA with Debian13
by kev dog 30 Mar '26

30 Mar '26

Thanks for any help. I'm using Debian 13 Trixie within a Proxmox LXC as a FreeIPA client. My FreeIPA server is run on Fedora 42. My IPA server version is VERSION: 4.12.5, API_VERSION: 2.254. I went through setting up freeipa-client on Debian. I have a working Arch Linux installation as another freeipa client and I compared a lot of the configuration with krb5.conf and sssd.conf to the working configuration. After working through the installation if I try to login as a FreeIPA user I get the following: $ su jax Password: su: Authentication failure At first glance I thought this immediately as a error related to PAM, however I checked the PAM modules files and found I have the following: $grep -R sss /etc/pam.d/ /etc/pam.d/common-session:session optional pam_sss.so /etc/pam.d/common-account:account [default=bad success=ok user_unknown=ignore] pam_sss.so /etc/pam.d/common-password:password sufficient pam_sss.so use_authtok /etc/pam.d/common-auth:auth [success=1 default=ignore] pam_sss.so use_first_pass My arch linux pam.d files were a lot different so I really couldn't compare the structure. I've confirmed I get a kerberos ticket issued for my pam user: $ kinit jax Password for jax@<DOMAIN>.COM: $ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: jax@<DOMAIN>.COM Valid starting Expires Service principal 10/19/2025 00:08:10 10/19/2025 23:53:28 krbtgt/DOMAIN(a)DOMAIN.COM I'm not sure where to look as journalctl isn't exactly helpful: $ sudo journalctl -g pam -b ... Oct 18 23:46:37 traefik.domain.com su[520]: pam_unix(su:auth): authentication failure; logname=kevdog uid=1000 euid=0 tty=/dev/pts/3 ruser=kevdog rhost= user=jax Oct 18 23:46:37 traefik.domain.com su[520]: pam_sss(su:auth): authentication failure; logname=kevdog uid=1000 euid=0 tty=/dev/pts/3 ruser=kevdog rhost= user=jax Oct 18 23:46:37 traefik.domain.com su[520]: pam_sss(su:auth): received for user jax: 4 (System error) For reference my sssd.conf if below: [domain/domain.com] id_provider = ipa ipa_server = ipa.domain.com ipa_domain = domain.com ipa_hostname = traefik.domain.com sudo_provider = ipa auth_provider = ipa chpass_provider = ipa access_provider = permit cache_credentials = True ldap_tls_cacert = /etc/ipa/ca.crt krb5_store_password_if_offline = True ldap_schema = ipa ldap_group_member = member enumerate = True default_shell = /usr/bin/bash use_fully_qualified_names = False fallback_homedir = /home/%u [sssd] services = nss, pam, ssh, sudo domains = domain.com [nss] homedir_substring = /home [pam] [sudo] [autofs] [ssh] [pac] [ifp] [session_recording]

3 2

IPA - various certs expired, tomcat and httpd not starting
by Tom Madureira 27 Mar '26

27 Mar '26

Hi All, I've done some searching around and tried various suggestions with no luck. Sadly it went unnoticed that our certs didn't renew despite being monitored w/ auto-renew enabled... We're running IPA 4.6.8 and likely since patched. We're working on a new cluster upgrade in parallel. My core issue is that our CA master (we have a handfull of replicas) did not auto renew on some of its certs more specifically - ldap, http. So httpd/pki fail to start. CA cert is fine. All other hosts in my replicated setup are fine too. I did try ipa-cert-fix which detects my problems. [Errno 2] No such file or directory: '/etc/pki/pki-tomcat/certs/2684223502-renewed.crt' The ipa-cert-fix command failed. # getcert list -n Server-Cert Number of certificates and requests being tracked: 10. Request ID '20220328233120': status: CA_UNREACHABLE ca-error: Server at https://ipa-02.bo1.dy.gl/ipa/xml failed request, will retry: -504 (libcurl failed to execute the HTTP POST transaction, explaining: Peer's Certificate has expired.). pki-tomcat won't start as it is failing to connect to ldap locally. Internal Database Error encountered: Could not connect to LDAP server host ipa-02.bo1.dy.gl port 636 Error netscape.ldap.LDAPException: Unable to create socket: org.mozilla.jss.ssl.SSLSocketException: org.mozilla.jss.ssl.SSLSocketException: SSL_ForceHandshake failed: (-8181) Peer's Certificate has expired. (-1) /usr/sbin/ns-slapd does appear to be running in my limited setup without exceptions ipactl status Directory Service: RUNNING (listening on ports) httpd Service: RUNNING (NSSEnforceValidCerts off) pki-tomcatd Service: STOPPED (this is running? well the proc is up, but throwing exceptions starting subsystems because of the ldap connection) ipa: INFO: The ipactl command was successful What's the easiest way out of this mess? Or what else can I dump for more insight here. Thanks for your help here.

4 5

subuids from both 'shadow' & IPA ?
by lejeczek 24 Mar '26

24 Mar '26

Hi guys. Having users with subuids in IPA and users not in IPA with subuilds - is it possible to have both work? This: -> $ authselect select sssd with-sudo with-sudo with-subid with-mkhomedir makes this: subid: sss files in: /etc/nsswitch.conf Which results in "shadow" OS' "regular" users failing to set up containers. If I in nsswitch.conf those two around, then vice-versa happens. Do you know if it is possible to make these to work and if so, then how? many thanks, L.

2 1

huge (and continually growing) database(s)
by Brian J. Murrell 20 Mar '26

20 Mar '26

The database(s) for my FreeIPA server on EL8 are big, and just continue to grow day after day. Currently they are at: 8.0K /var/lib/dirsrv/slapd-EXAMPLE-COM/bak 8.0K /var/lib/dirsrv/slapd-EXAMPLE-COM/ldif 3.4M /var/lib/dirsrv/slapd-EXAMPLE-COM/db/ipaca 75M /var/lib/dirsrv/slapd-EXAMPLE-COM/db/changelog 188M /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot 1.3G /var/lib/dirsrv/slapd-EXAMPLE-COM/db 3.7G /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb 5.0G /var/lib/dirsrv/slapd-EXAMPLE-COM/ Specifically: /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/: total 3.7G 3.7G -rw-------. 1 dirsrv dirsrv 3.7G Mar 17 13:14 1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db 8.9M -rw-------. 1 dirsrv dirsrv 8.9M Mar 17 12:49 a17fa5ab-82ed11ec-88b1dfba-ae19c7b5_61e5bbce000000060000.db 4.0K -rw-------. 1 dirsrv dirsrv 30 Jan 31 2022 DBVERSION /var/lib/dirsrv/slapd-EXAMPLE-COM/db/: total 1.1G 4.0K drwx------. 2 dirsrv dirsrv 4.0K Jan 31 2022 changelog 18M -rw-------. 1 dirsrv dirsrv 29M Mar 17 13:15 __db.001 56M -rw-------. 1 dirsrv dirsrv 56M Mar 17 13:15 __db.002 979M -rw-------. 1 dirsrv dirsrv 979M Mar 17 13:15 __db.003 4.0K -rw-------. 1 dirsrv dirsrv 51 Dec 7 18:35 DBVERSION 4.0K drwx------. 2 dirsrv dirsrv 4.0K Mar 9 2023 ipaca 9.4M -rw-------. 1 dirsrv dirsrv 10M Mar 17 13:15 log.0000015747 4.0K drwx------. 2 dirsrv dirsrv 4.0K Oct 8 16:36 userRoot For some historical comparison, using that largest .db file: -rw-------. 1 dirsrv dirsrv 187965440 Jan 20 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 364732416 Dec 8 2023 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 396328960 Jan 12 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 410517504 Feb 8 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 418586624 Feb 22 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 456179712 Mar 15 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 485425152 Apr 7 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 562569216 May 28 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 662282240 Sep 6 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 761552896 Oct 13 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 822583296 Nov 7 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1131560960 Dec 15 2024 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1306206208 Jan 12 2025 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1427832832 Feb 9 2025 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1603928064 Mar 16 2025 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1785995264 Apr 13 2025 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 1937391616 May 10 2025 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 2089877504 Jun 5 2025 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 2355585024 Jul 1 2025 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 2534252544 Aug 10 2025 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 2664218624 Sep 8 2025 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 2883969024 Oct 5 02:22 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3015147520 Oct 27 00:44 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3070935040 Nov 9 03:19 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3102433280 Nov 16 01:56 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3134611456 Nov 23 01:18 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3161931776 Nov 30 01:35 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3189358592 Dec 7 02:06 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3256328192 Dec 20 02:38 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3293446144 Dec 27 02:00 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3343654912 Jan 4 02:53 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3388170240 Jan 11 04:20 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3657154560 Jan 19 03:13 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3808010240 Feb 14 04:27 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3813777408 Feb 15 02:24 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3819601920 Feb 16 03:17 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3825131520 Feb 17 06:57 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3829620736 Feb 18 03:52 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3837059072 Feb 19 04:28 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3841392640 Feb 20 03:07 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3845234688 Feb 21 01:47 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3850117120 Feb 22 03:08 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3854262272 Feb 23 02:29 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3858604032 Feb 24 02:30 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3862708224 Feb 25 01:49 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3867582464 Feb 26 04:48 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3871596544 Feb 27 03:47 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3875438592 Feb 28 02:14 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3879821312 Mar 1 04:18 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3883778048 Mar 2 03:04 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3888021504 Mar 3 02:01 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3892813824 Mar 4 02:05 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3897606144 Mar 5 03:26 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3902193664 Mar 6 04:24 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3906756608 Mar 7 05:28 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3911139328 Mar 8 05:37 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3926228992 Mar 11 14:45 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3934699520 Mar 13 10:19 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db -rw-------. 1 dirsrv dirsrv 3944226816 Mar 15 10:50 /var/lib/dirsrv/slapd-EXAMPLE-COM/cldb/1e5e4f8c-82ed11ec-88b1dfba-ae19c7b5_61e5b9dd000000040000.db As you can see, it just grows without bound. Now I read recently that having an offline replica can cause this kind of unbounded growth, and it makes sense why that would be. I had a replica that was offline for literally years -- since my last IPA upgrade in fact. I was so hopeful that removing that offline replica from the installation would purge a lot of this unbounded database growth, but it's still 3.7G after doing an "ipa server-del" on the offline server: # ipa server-del server-staging.example.com Removing server-staging.example.com from replication topology, please wait... ipa: WARNING: Failed to remove server from security domain: Failed to authenticate to CA REST API --------------------------------------------------- Deleted IPA server "server-staging.example.com" --------------------------------------------------- Despite the warning, the replica does seem to be removed though: # ipa server-find -------------------- 1 IPA server matched -------------------- Server name: server.example.com Min domain level: 1 Max domain level: 1 ---------------------------- Number of entries returned 1 ---------------------------- Any thoughts on all of this? I really need to get the unbounded growth of this database under control. Any further ideas on that if the above was a red-herring? Cheers, b.

3 11

Fresh install of 4.12.2 with intermittent Login problems
by Freeipa Users 20 Mar '26

20 Mar '26

Good day, thank you for a wonderful identity management solution. We are excited to see most of what we need as admins under one roof: FreeIPA. However, often accounts become inaccessible. Web UI works, kinit not, SSH works. Or vice versa. Its like "kinit admin" -> successful result in "klist" and then one uses the same credentials for the Web UI and gets "The password or username you entered is incorrect" or the other way round. Plain password, though OTP etc are options. When tickets expire it is also a show-stopper. The instance is a straightforward RHEL 10.1 on bare metal (HPE Proliant) with minimal add-ons (google-authenticator, qrencode, emacs-nox) and modifications (inputrc, automatic.conf). I have set LANG from de_DE.UTF-8 to en_US.UTF-8 and rebooted. Any help would be greatly appreciated, so that we can put this instance into production. Yours sincerely The admins from the sender address ipa-server-4.12.2-24.el10_1.1.x86_64 ipa-client-4.12.2-24.el10_1.1.x86_64 389-ds-base-3.1.3-7.el10_1.x86_64 Das Paket pki-ca ist nicht installiert krb5-server-1.21.3-8.el10_0.x86_64 cat /etc/os-release NAME="Red Hat Enterprise Linux" VERSION="10.1 (Coughlan)" /var/log/krb5kdc.log for unsuccessful Web UI login by "admin" Mar 16 17:18:59 freeipa-01... krb5kdc[2926](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) ...: NEEDED_PREAUTH: WELLKNOWN/ANONYMOUS@... for krbtgt/...@..., Additional pre-authentication required Mar 16 17:18:59 freeipa-01... krb5kdc[2926](info): closing down fd 11 Mar 16 17:18:59 freeipa-01... krb5kdc[2930](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) ...: ISSUE: authtime 1773677939, etypes {rep=aes256-cts-hmac-sha384-192(20), tkt=aes256-cts-hmac-sha384-192(20), ses=aes256-cts-hmac-sha384-192(20)}, WELLKNOWN/ANONYMOUS@... for krbtgt/...@... Mar 16 17:18:59 freeipa-01... krb5kdc[2930](info): closing down fd 11 Mar 16 17:18:59 freeipa-01... krb5kdc[2924](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) ...: NEEDED_PREAUTH: admin@... for krbtgt/...@..., Additional pre-authentication required Mar 16 17:18:59 freeipa-01... krb5kdc[2924](info): closing down fd 11 Mar 16 17:18:59 freeipa-01... krb5kdc[2922](info): preauth (otp) verify failure: Generic preauthentication failure Mar 16 17:18:59 freeipa-01... krb5kdc[2922](info): AS_REQ (4 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17)}) ...: PREAUTH_FAILED: admin@... for krbtgt/...@..., Preauthentication failed Mar 16 17:18:59 freeipa-01... krb5kdc[2922](info): closing down fd 11 otp? ipa user-show Principal name: admin@... User authentication types: password, otp, pkinit, passkey ipa config-show --all Default user authentication types: otp, pkinit, passkey, password

3 7

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users March 2026