BSD Ports

net/freeipa-server 4.13.4 FreeBSD

FreeIPA server

System
FreeBSD
Repository
FreeBSD ports
Maintainer
[email protected]
Port added
Last update
Commit
d991e32ce4
License
GPLv3+
Categories
net
Package size
11309.6 KiB, 73578.1 KiB installed

Description

FreeIPA server provides integrated identity management, authentication, authorization, and policy services based on LDAP, Kerberos, DNS, and PKI technologies.

Install

Binary package:

pkg install freeipa-server

From the ports tree:

cd /usr/ports/net/freeipa-server/ && make install clean

To depend on this port in another port's Makefile:

RUN_DEPENDS=	freeipa-server>0:net/freeipa-server

Packages

The version each package repository carries. “-” means the repository builds no package of it, “n/a” that there is no such repository.

Repositoryaarch64amd64armv6armv7i386
FreeBSD:14:latest4.13.44.13.4--4.13.4
FreeBSD:14:quarterly4.13.44.13.4n/a-4.13.4
FreeBSD:15:latest4.13.44.13.4n/a--
FreeBSD:15:quarterly4.13.44.13.4n/an/an/a
FreeBSD:16:latest4.13.44.13.4n/an/an/a
FreeBSD:16:quarterlyn/an/an/an/an/a

Dependencies

As this port's Makefile names them.

Build 7

Library 13

Runtime 33

The full lists below include those, and their dependencies in turn.

Build dependencies 151

The first 100 are listed.

Run dependencies 245

The first 100 are listed.

No port depends on this one.

Configuration

Options name: net_freeipa-server

OptionDefaultDescription
DOCSoffBuild and/or install documentation
USES
autoreconf cpe gettext-runtime gettext-tools gmake gssapi:mit iconv ldap libtool localbase:ldflags nodejs:build pkgconfig python samba shebangfix ssl
Service scripts
ipa-custodia, freeipa-server
Conflicts with
freeipa-client

Message after installing

======================================================================
 ATTENTION - REQUIRED before you run ipa-server-install
======================================================================

  >>> Read /usr/local/share/doc/freeipa-server/README.md first,
  >>> section "Prerequisites (read this first)".

FreeIPA on FreeBSD uses the MIT Kerberos from ports (security/krb5).
The SASL/GSSAPI plugin that the final "client enrolment" step of
ipa-server-install relies on MUST use that SAME Kerberos - otherwise the
install runs all the way through and then fails at the very end with:

    Insufficient access: SASL(-1): generic failure: GSSAPI Error:
    ... (SPNEGO cannot find mechanisms to negotiate)
  or
    ... Cannot find KDC for realm "EXAMPLE.COM"

By default security/cyrus-sasl2-gssapi is built with GSSAPI_BASE, which
links the BASE-system Kerberos (/usr/lib/libgssapi_krb5) and reads
/etc/krb5.conf - the wrong Kerberos for FreeIPA. You MUST rebuild it with
the GSSAPI_MIT option so it links the ports Kerberos
(/usr/local/lib/libgssapi_krb5) and reads /usr/local/etc/krb5.conf:

  * via make.conf (ports / poudriere):

        security_cyrus-sasl2-gssapi_SET=GSSAPI_MIT
        security_cyrus-sasl2-gssapi_UNSET=GSSAPI_BASE
        security_py-gssapi_SET=GSSAPI_MIT
        security_py-gssapi_UNSET=GSSAPI_BASE

  * or interactively, then rebuild + reinstall the plugin:

        make -C /usr/ports/security/cyrus-sasl2-gssapi config
        # select GSSAPI_MIT, deselect GSSAPI_BASE

Verify the plugin now links the ports Kerberos:

        ldd /usr/local/lib/sasl2/libgssapiv2.so | grep libgssapi_krb5
        # MUST show /usr/local/lib/libgssapi_krb5.so
        # NOT     /usr/lib/libgssapi_krb5.so.*

The Python bindings security/py-gssapi need the same GSSAPI_MIT choice;
ipalib uses them for the kinit during self-enrolment, and with the base
Kerberos the install fails at the very end with "Cannot find KDC".

Note: this is a system-wide choice. All SASL/GSSAPI consumers (SSSD,
OpenLDAP, Postfix, ...) will then use the ports MIT Kerberos - which is
the correct, consistent setup on a host dedicated to FreeIPA.

Full details and the rest of the prerequisites (FQDN, /etc/hosts,
D-Bus/dbus_enable, cloud-init manage_etc_hosts, reboot persistence):

        /usr/local/share/doc/freeipa-server/README.md
======================================================================

Files

Manual pages 30
  • ipa-acme-manage(1)
  • ipa-adtrust-install(1)
  • ipa-advise(1)
  • ipa-backup(1)
  • ipa-ca-install(1)
  • ipa-cacert-manage(1)
  • ipa-cert-fix(1)
  • ipa-compat-manage(1)
  • ipa-crlgen-manage(1)
  • ipa-csreplica-manage(1)
  • ipa-dns-install(1)
  • ipa-idrange-fix(1)
  • ipa-kra-install(1)
  • ipa-ldap-updater(1)
  • ipa-managed-entries(1)
  • ipa-migrate(1)
  • ipa-otptoken-import(1)
  • ipa-pkinit-manage(1)
  • ipa-replica-conncheck(1)
  • ipa-replica-install(1)
  • ipa-replica-manage(1)
  • ipa-restore(1)
  • ipa-run-tests(1)
  • ipa-server-certinstall(1)
  • ipa-server-install(1)
  • ipa-server-upgrade(1)
  • ipa-test-config(1)
  • ipa-test-task(1)
  • ipa-winsync-migrate(1)
  • ipactl(8)
pkg-plist 3292
  • %%PYTHON_SITELIBDIR%%/ipaclient--py.egg-info/PKG-INFO
  • %%PYTHON_SITELIBDIR%%/ipaclient--py.egg-info/SOURCES.txt
  • %%PYTHON_SITELIBDIR%%/ipaclient--py.egg-info/dependency_links.txt
  • %%PYTHON_SITELIBDIR%%/ipaclient--py.egg-info/entry_points.txt
  • %%PYTHON_SITELIBDIR%%/ipaclient--py.egg-info/not-zip-safe
  • %%PYTHON_SITELIBDIR%%/ipaclient--py.egg-info/requires.txt
  • %%PYTHON_SITELIBDIR%%/ipaclient--py.egg-info/top_level.txt
  • %%PYTHON_SITELIBDIR%%/ipaclient/__init__.py
  • %%PYTHON_SITELIBDIR%%/ipaclient/__main__.py
  • %%PYTHON_SITELIBDIR%%/ipaclient/__pycache__/__init__.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/__pycache__/__init__.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/__pycache__/__main__.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/__pycache__/__main__.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/__pycache__/discovery.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/__pycache__/discovery.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/__pycache__/frontend.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/__pycache__/frontend.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/discovery.py
  • %%PYTHON_SITELIBDIR%%/ipaclient/frontend.py
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__init__.py
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/__init__.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/__init__.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/automount.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/automount.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/client.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/client.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/ipa_certupdate.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/ipa_certupdate.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/ipa_client_automount.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/ipa_client_automount.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/ipa_client_install.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/ipa_client_install.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/ipa_client_samba.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/ipa_client_samba.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/ipa_epn.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/ipa_epn.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/ipachangeconf.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/ipachangeconf.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/ipadiscovery.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/ipadiscovery.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/sssd.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/sssd.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/timeconf.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/__pycache__/timeconf.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/automount.py
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/client.py
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/ipa_certupdate.py
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/ipa_client_automount.py
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/ipa_client_install.py
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/ipa_client_samba.py
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/ipa_epn.py
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/ipachangeconf.py
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/ipadiscovery.py
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/sssd.py
  • %%PYTHON_SITELIBDIR%%/ipaclient/install/timeconf.py
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__init__.py
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/__init__.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/__init__.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/automember.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/automember.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/automount.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/automount.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/baseuser.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/baseuser.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/ca.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/ca.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/cert.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/cert.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/certmap.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/certmap.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/certprofile.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/certprofile.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/dns.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/dns.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/hbacrule.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/hbacrule.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/hbactest.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/hbactest.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/host.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/host.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/idrange.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/idrange.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/internal.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/internal.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/location.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/location.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/migration.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/migration.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/misc.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/misc.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/otptoken.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/otptoken.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/otptoken_yubikey.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/otptoken_yubikey.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/passwd.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/passwd.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/permission.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/permission.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/rpcclient.opt-1.pyc
  • %%PYTHON_SITELIBDIR%%/ipaclient/plugins/__pycache__/rpcclient.pyc

The first 100 are listed.

distinfo 1
FileSizeSHA256
freeipa-4.13.4.tar.gz4.8760674e+07b2f24d763875a9b5677384f7c6232291c641f5c3c2412614a8b8548b47416023
Master sites 1
  • https://codeberg.org/freeipa/freeipa/releases/download/release-${DISTVERSION:S/./-/g}/

Commit history 8

DateCommitCreditsLog message
d991e32ce4 Jochen Neumeister net/freeipa-server: Update to 4.13.4
Includes the 4.13.3 release. Adds a mod_reqtimeout slow-read configuration to ipa.conf, removes the two minute delay from DNA configuration during installation and updates the WebUI to 0.2.1. Changes: https://www.freeipa.org/release-notes/4-13-3.html Changes: https://www.freeipa.org/release-notes/4-13-4.html Security: 9736fef3-ada6-11f1-a655-3497f65b111b Sponsored by: Netzkommune GmbH
5a5b9bff28 Jochen Neumeister net/freeipa-server: Add CPE information
Sponsored by: Netzkommune GmbH
210df49f64 Jochen Neumeister net/freeipa-server: fix documentation
Rework the installed README. Sponsored by: Netzkommune GmbH
4c8bd7aad9 Jochen Neumeister net/freeipa-server: Fix client enrollment paths
ipa-join used the upstream default /etc/ipa/ca.crt, so it could not build a TLS context and enrollment stopped at "Unable to determine root DN". The client port already patches this constant; the server port ships the same ipaclient tree and needs it too. configure_krb5_snippet() copied its snippet into a krb5.conf.d that nothing creates, which aborted the install with FileNotFoundError. It now creates the directory, which is where FreeIPA points krb5.conf's includedir anyway. Reported by: usenix17 https://github.com/joneum/FreeBSD-freeipa-server/issues/3 Sponsored by: Netzkommune GmbH
0720a1d8ab Jochen Neumeister net/freeipa-server: Respect PREFIX and fix service restarts
The patches hardcoded /usr/local. They now carry %%PREFIX%% for this port's own files and %%LOCALBASE%% for what other ports install, substituted in post-patch. Two restart fixes: the rc script passes --ignore-service-failures on restart as it already does on start, so one failing service no longer takes the Directory Server down with it, and FreeBSDService re-checks a service after a failed rc action instead of trusting a status check that raced the pidfile. Sponsored by: Netzkommune GmbH

The latest 5 of 8 in the history this site was built from.