FreeIPA-users July 2026

freeipa-users@lists.fedorahosted.org

10 participants
4 discussions

Issue with modern UI
by Orion Poplawski 20 Jul '26

20 Jul '26

We're running IPA on EL9. With the classic UI I can log out of my default user that auto logins with GSSAPI and then login as the admin. With the "modern UI" the logout button does nothing and I just keep going back to the modern UI. The "Profile" section also seems to do nothing. Are these known issues? I'd hate to eventually get stuck with only the modern UI and not be able to log out. Orion -- Orion Poplawski he/him/his - surely the least important thing about me Manager of IT Systems 720-772-5637 NWRA, Boulder Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 https://www.nwra.com/

1 0

sudo not working anymore after upgrade to Ubuntu 26
by Andreas Bulling 18 Jul '26

18 Jul '26

Hi all, I've been running FreeIPA without major issues for years, connecting various Ubuntu machines as clients - most running Ubuntu 24. I upgraded three of them to Ubuntu 26 today and noticed that, while I can still login using SSH (public-key auth), sudo is not working anymore. I have not touched the sudoers configuration on the FreeIPA server side - I just updated Ubuntu on these three servers. Those running Ubuntu 24 are still working fine incl. sudo This is what I see in /var/log/auth.log 2026-07-17T16:57:52.122663+02:00 cloud sshd-session[3029]: Accepted publickey for REDACTED from REDACTED port 53988 ssh2: RSA REDACTED 2026-07-17T16:57:52.138883+02:00 cloud sshd-session[3029]: pam_unix(sshd:session): session opened for user REDACTED(uid=REDACTED) by REDACTED(uid=0) 2026-07-17T16:57:52.162575+02:00 cloud systemd-logind[1387]: New session '34' of user 'REDACTED' with class 'user' and type 'tty'. 2026-07-17T16:57:52.213586+02:00 cloud (systemd): pam_sss(systemd-user:account): Access denied for user REDACTED: 6 (Permission denied) 2026-07-17T16:57:52.213829+02:00 cloud (systemd): PAM PAM failed: Permission denied Not sure which other logfiles might be useful for debugging - here are two that are probably involved: # /etc/nsswitch.conf # # Example configuration of GNU Name Service Switch functionality. # If you have the `glibc-doc-reference' and `info' packages installed, try: # `info libc "Name Service Switch"' for information about this file. passwd: files systemd sss group: files systemd sss shadow: files sss gshadow: files hosts: files dns networks: files protocols: db files services: db files sss ethers: db files rpc: db files netgroup: nis sss sudoers: files sss automount: sss ii freeipa-client 4.13.1-1 amd64 FreeIPA centralized identity framework -- client ii freeipa-common 4.13.1-1 all FreeIPA centralized identity framework -- common files sudo -l sudo: Sorry, user REDACTED may not run sudo on REDACTED.

6 9

FreeIPA 4.13.2
by Antonio Torres 16 Jul '26

16 Jul '26

The FreeIPA team would like to announce the FreeIPA 4.13.2 release! It can be downloaded from http://www.freeipa.org/page/Downloads. Builds for Fedora distributions will be available from the official repository soon. Full release notes are available at: https://www.freeipa.org/release-notes/4-13-2.html

1 0

How to restrict a user to only view its own entry?
by Alex Crow 14 Jul '26

14 Jul '26

I've been trying to no avail to get this to work - I have a couple of users that I want to be able to bind via simple LDAP over TLS but only see their own entry. I've been playing with Roles, Privileges and Permissions but I can't get this to work. One of the parts I've seen in some online documentation says to create a normal permissions, with read search and compare rights, and use an "Extra Target Filter" of "(uid=${user})". Despite assigning this to a Privilege and a Role, and giving only that role to an account, that account can still read everyone else's entries and attributes. Is there any way to make this work? This is my permission entry: # ipa permission-show "Only access self" Permission name: Only access self Granted rights: read, search, compare Effective attributes: cn, createtimestamp, employeetype, entryusn, givenname, homedirectory, loginshell, mail, memberof, mobile, modifytimestamp, objectclass, ou, sn, title, uid, uidnumber, usercertificate Bind rule type: permission Subtree: cn=users,cn=accounts,dc=ipa,dc=roadtech,dc=internal Extra target filter: (uid=${user}) Target DN: cn=users,cn=accounts,dc=ipa,dc=roadtech,dc=internal Type: user Permission flags: SYSTEM, V2 Granted to Privilege: restricted_user Indirect Member of roles: Only self Now what I'm unsure of is the extra filter, does this variable "$user" even exist? I can't find anything in the IPA docs about variables that can be used in filters. I've also tried changing $user to the actual UID of the user I'm working with and it still had no effect, the user can still see everything (unprivileged attributes only but all the rest are there).

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

FreeIPA-users July 2026