This page contains troubleshooting advice for FreeIPA server installation.For trouble shooting other issues, refer to the index at Troubleshooting.

Install Free Ipa Clients
Freeipa Windows Client

IPA authentication for use on clients. IPA is an integrated solution to provide centrally managed Identity (users, hosts, services), Authentication (SSO, 2FA), and Authorization (host access control, SELinux user roles, services). Base client module¶ Lightweight FreeIPA JSON RPC client. Class pythonfreeipa.client.AuthenticatedSession (client,.loginarguments,.kwargs) ¶ Context manager class that automatically logs out upon exit. Loggedin¶ Returns True if and only if the login attempt succeeded.

3Replica Installation
4Client Installation

Install Free Ipa Clients

When installation crashes, check installation log in /var/log/ipaserver-install.log.

If the installation crashed on installing PKI server (Dogtag), check it's logs as well. The most useful logs are the following:

/var/log/pki/pki-ca-spawn.$TIME_OF_INSTALLATION.log
/var/log/pki/pki-tomcat/catalina.out
/var/log/pki/pki-tomcat/ca/system
/var/log/pki/pki-tomcat/ca/debug

If you see in ipaserver-install.log line:/usr/bin/runcon: invalid context: unconfined_u:system_r:pki_ca_script_t:s0:Invalid argument' Then the culprit might be that pki-selinux failed to load its policy. The best thing to do is to force re-installpki-selinux (and check for any errors in the /var/log/messages file or journal).

When installation crashes, check installation log in /var/log/ipareplica-install.log. When CA is being installed on a replica, check the aforementioned PKI logs as well.

Migrating from RHEL 6/CentOS 6

Installation of certificate server fails with:
It indicates bug 1322059. Issue is that RHEL6, while creating replica file, uses certificates from a file which was created during server installation and potentially contains expired certificates instead of fetching the certs from database where they are valid. It is fixed on FreeIPA 3.2+. Recovery is to update the file with valid certs and then run ipa-replica-prepare again and try replica installation again:
1. create a /root/dbpass file containing the 'internal' (not 'internaldb') password from /etc/pki-ca/password
2. create a /root/dmpass file containing the DM password
3. run PKCS12Export:

Installation of certificate server fails with:
It indicates bug 1256039. The issue is that certificate server users on master server has invalid, usually expired cert, in its database entry even though all certs tracked by certmonger are valid. Recovery is to update the database entry with correct certificate. Run following script or use manual method is described at freeipa users list mail.

Replica Installation fails with Invalid Credentials

Installation of the replica fails with:

This can happen when the ipa-replica-install command is called with --no-ntp and the clocks of the master and the replica are not in sync. Once they are synchronized (either manually or with NTP or chrony), ipa-replica-install should succeed

When installation does not work as expected, check installation log in /var/log/ipaclient-install.log. You can run installation in verbose mode if you run ipa-client-install with --debug option. (Log files always contain debug information, so you do not need to re-run installation with --debug option.)

Installation breaks on decoding/downloading CA certificate

`ipa-client-install` may crash with error like
ipalib.errors.LDAPError: failed to decode certificate: (SEC_ERROR_INVALID_ARGS) security library: invalid arguments.
This may mean that PKI CA Certificate stored in LDAP was not properly imported during upgrade in some of the older versions
Verify that the CA certificate is stored correctly
$ ldapsearch -h your.ipa.server.fqdn -x -b 'cn=CAcert,cn=ipa,cn=etc,dc=example,dc=test'
The cACertificate;binary should contain the encoded certificate, typically starting with MII characters
If the certificate is missing, go to any FreeIPA master to let updater regenerate it:
# kinit admin
# ldapdelete -Y GSSAPI 'cn=CAcert,cn=ipa,cn=etc,dc=example,dc=test'
# ipa-ldap-updater --upgrade

Failed to update DNS records

Freeipa Windows Client

When client cannot update the DNS record in FreeIPA managed DNS zone:

Make sure that the respective FreeIPA DNS zone has Dynamic Updates option enabled:

Make sure that the FreeIPA server with DNS service has port 53 opened for both UDP and TCP (related user case)

Installation breaks on Joining realm

ipa-client-install may fail with the following error:

This failure may be caused by an empty /etc/krb5.keytab. In this case, simply delete the file and restart the installation.

Retrieved from 'https://www.freeipa.org/index.php?title=Troubleshooting/Installation&oldid=15351'

First, let me apolgize for the odd, low quality that I have gotten out of my first 2 screen recordings. I'd love to blame it on Youtube, but I think it's just an effect from accidentally recording the wrong aspect ration on my iMac that runs Linux. Anyway, recorded the rest of the series on a different machine at proper 16:9 1920x1080, so those should be better.

Preparing our Server Machine for Install

Using Fedora 32 for our FreeIPA server, we need to get a few things cleaned up inside the system. So you can do all of these steps through the CLI on SSH, or you can use the Virt-Manager to view the actual desktop.

Sirst, let's run a couple of commands to make sure the system is fully up to date.

sudo dnf update -y

Once that completes, just reboot the server, and continue forward.

Setup our Network Interface

NOTE: I did this same set of steps on both my server (Fedora 32 Workstation) and client (Ubuntu 20.04) machines. Feel free to work on both at once if you like for this portion.

Next, let's set our network interface up to keep the IP it was given through DHCP, or set it up to request the static IP of your choosing on your network.

I did this step through the network manager UI, as for me it's just easier.

Open your Network Manager, and select the wired interface (this should be the only option in the virtual machines).

Next, click the settings gear icon for the wired interface. In the view that opens, make note of the assigned IP address (if you want to keep it, and use it), the DNS Mask, DNS IP address, and Gateway address.

Now, click on the IPv4 tab, and choose Manual from the options at the top. Next, enter the IP address from above (or the IP address you want the machine to have), then the DNS Mask (usually 255.255.255.0), and the Gateway IP Address.

Now, move down the interface to the DNS section and turn off automatic. Enter the DNS IP you saw previously (may be the same as the Gateway IP, but if you run your own DNS server, feel free to use that IP).

Save / Apply your changes, then turn off the Wired interface and turn it back on to get the changes to take effect.

Set the Hostname of the Server and Client Virtual Machines

Now we'll set the hostname of the server and client VM's. There is only 1 difference between these setup steps, and I'll point that out below when you get to it.

First, lets set the proper hostname for each machine in the /etc/hostname file.

You need to decide now what you want for your machine's FQDN (Fully Qualified Domain Name). This is a name similar to a website address. For my server I'll be using ipasrv.myhome.local, and for my client I'll be using ipa01.myhome.local.

You want to know the following values moving forward:

Server IP Mine is 192.168.7.154
Client IP Mine is 192.168.7.153
Server FQDN / hostname Mine is ipasrv.myhome.local
Client FQDN