freeipa

#9821 Last successful login timestamps lost when upgrading FreeIPA cluster
Closed: invalid by abbra. Opened by jsf9k.

Closed: invalid
Reopen Issue

Issue

When I upgrade my FreeIPA cluster (three instances in AWS) I lose the last successful authentication timestamps, as described here. This is a problem for me because I rely on those timestamps to identify (and disable) inactive users.

(@rcritten was working with me on this issue via the mailing list, but since the mailing list website has been down for a few days (and for posterity) I thought I would collect the information here and continue on.)

Steps to Reproduce

Start with three FreeIPA instances (ipa0, ipa1, and ipa2), which are all replicating against one another. Upgrade the cluster with a new AMI via the following instructions:
1. Make ipa2 the CA renewal master by running this command on ipa0: ipa config-mod --ca-renewal-master-server ipa2.<DOMAIN>
2. Stop CRL generation on ipa0 by running this command on that instance: ipa-crlgen-manage disable
3. Start CRL generation on ipa2 by running this command on that instance: ipa-crlgen-manage enable
4. Capture the DNA ranges via ipa-replica-manage dnarange-show
5. Remove ipa0 from the cluster by running these three commands on ipa2:
ipa server-del --ignore-topology-disconnect ipa0.<DOMAIN> && for id in $(ipa cert-find --sizelimit=0 --status=VALID --subject=ipa0.<DOMAIN> | grep "Serial number:" | sed "s/^\ *Serial number: //"); do ipa cert-revoke $id --revocation-reason=5; done && ipa-replica-manage del ipa0.<DOMAIN>
6. Terminate ipa0
7. Similarly remove ipa1 from the cluster by running analogues of the same three commands, again from ipa2
8. Terminate ipa1
9. Upgrade ipa2 in situ by running this command on that instance: dnf upgrade freeipa-server
10. Recreate ipa0 by spinning up a new instance in AWS and then rejoining it to the cluster by running 00_setup_freeipa.sh replica (made available on the Fedora 42 FreeIPA AMIs we build). Note that this script essentially runs ipa-client-install followed by ipa-replica-install.
11. Replace the ipa0 DNS range via something like ipa-replica-manage dnarange-set ipa0.<DOMAIN> 85200139-85300499
12. Make ipa0 the renewal master by running the following command on ipa2: ipa config-mod --ca-renewal-master-server ipa0.<DOMAIN>
13. Move CRL generation back to ipa0 by running ipa-crlgen-manage disable on ipa2 followed by ipa-crlgen-manage enable on ipa0
14. Recreate ipa0 and rejoin it to the cluster by repeating step 10 with ipa0 replaced by ipa1
15. Replace any missing domain or ca replication agreements via ipa topologysegment-find domain|ca and ipa topologysegment-add domain|ca ...
16. Replace the ipa1 DNS range via something like ipa-replica-manage dnarange-set ipa1.<DOMAIN> 85300504-85350249
17. Remove ipa2 from the cluster by running the commands in step 5 on ipa0 or ipa1, using ipa2 in place of ipa0
18. Terminate ipa2
19. Recreate ipa2 and rejoin it to the cluster by repeating step 10 with ipa0 replaced by ipa2
20. Again replace any missing domain or ca replication agreements via ipa topologysegment-find domain|ca and ipa topologysegment-add domain|ca ...
21. Replace the ipa2 DNS range via something like ipa-replica-manage dnarange-set ipa2.<DOMAIN> 85350250-85399999
22. Clean any dangling RUVs via ipa-replica-manage clean-dangling-ruv

Now run ipa user-status first.last and observe that the last authentication timestamps are all null.

Actual behavior

The last authentication timestamps for all users on, e.g., ipa0 are all null after removing ipa0 from the cluster, terminating it, spinning up a new instance via a new AMI, and rejoining the new instance to the cluster.

Expected behavior

I'd like to change my process to still spin up a new FreeIPA server via a new AMI, but somehow still preserve the existing last authentication timestamps.

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
freeipa-server-4.12.2-13.fc42.x86_64
freeipa-client-4.12.2-13.fc42.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-3.1.2-4.fc42.x86_64
package pki-ca is not installed
krb5-server-1.21.3-6.fc42.x86_64

Additional info:

Any additional information, configuration, data or log snippets that is needed for reproduction or investigation of the issue.

Log file locations: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/config-files-logs.html
Troubleshooting guide: https://www.freeipa.org/page/Troubleshooting

In a previous conversation on the mailing list, @rcritten asked me to enable 389-ds audit logging and watch to see when the last authentication timestamps are destroyed as I went through my process. I did that on ipa2 as I went through steps 1-6 above, but I don't see the last authentication timestamps being destroyed. I do see traffic related to ipa0 being removed:

time: 20250702161714
dn: cn=ipa0.<DOMAIN>:443,cn=KRAList,ou=Security Domain,o=ipaca
result: 0
changetype: delete
modifiersname: uid=pkidbuser,ou=People,o=ipaca
time: 20250702161715
dn: cn=ipa0.<DOMAIN>:443,cn=CAList,ou=Security Domain,o=ipaca
result: 0
changetype: delete
modifiersname: uid=pkidbuser,ou=People,o=ipaca
time: 20250702161717
dn: cn=ipa-http-delegation,cn=s4u2proxy,cn=etc,dc=<DOMAIN>
result: 0
changetype: modify
delete: memberPrincipal
memberPrincipal: HTTP/ipa0.<DOMAIN>@<DOMAIN>
-
replace: modifiersname
modifiersname: uid=first.last,cn=users,cn=accounts,dc=dev-a,dc=cool,dc=cyb
 er,dc=dhs,dc=gov
-
replace: modifytimestamp
modifytimestamp: 20250702161716Z
-
replace: entryusn
entryusn: 210736
-
time: 20250702161717
dn: cn=ipa-ldap-delegation-targets,cn=s4u2proxy,cn=etc,dc=<DOMAIN>
result: 0
changetype: modify
delete: memberPrincipal
memberPrincipal: ldap/ipa0.<DOMAIN>@<DOMAIN>
-
replace: modifiersname
modifiersname: uid=first.last,cn=users,cn=accounts,dc=dev-a,dc=cool,dc=cyb
 er,dc=dhs,dc=gov
-
replace: modifytimestamp
modifytimestamp: 20250702161717Z
-
replace: entryusn
entryusn: 210738
-
time: 20250702161717
dn: dnaHostname=ipa0.<DOMAIN>+dnaPortNum=0,cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161717
dn: dnaHostname=ipa0.<DOMAIN>+dnaPortNum=389,cn=posix-ids,cn=dna,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161718
dn: dnaHostname=ipa0.<DOMAIN>+dnaPortNum=0,cn=subordinate-ids,cn=dna,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161718
dn: dnaHostname=ipa0.<DOMAIN>+dnaPortNum=389,cn=subordinate-ids,cn=dna,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161718
dn: cn=default,ou=profile,dc=<DOMAIN>
result: 0
changetype: modify
replace: defaultServerList
defaultServerList: ipa1.<DOMAIN> ipa2.<DOMAIN>
-
replace: modifiersname
modifiersname: uid=first.last,cn=users,cn=accounts,dc=dev-a,dc=cool,dc=cyb
 er,dc=dhs,dc=gov
-
replace: modifytimestamp
modifytimestamp: 20250702161718Z
-
replace: entryusn
entryusn: 210743
-
time: 20250702161718
dn: cn=sig/ipa0.<DOMAIN>,cn=custodia,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161718
dn: cn=enc/ipa0.<DOMAIN>,cn=custodia,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161719
dn: cn=sig/ipa0.<DOMAIN>,cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161719
dn: cn=enc/ipa0.<DOMAIN>,cn=dogtag,cn=custodia,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161719
dn: krbprincipalname=ldap/ipa0.<DOMAIN>@<DOMAIN>,cn=services,cn=accounts,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161720
dn: krbprincipalname=HTTP/ipa0.<DOMAIN>@<DOMAIN>,cn=services,cn=accounts,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161720
dn: krbprincipalname=dogtag/ipa0.<DOMAIN>@<DOMAIN>,cn=services,cn=accounts,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161720
dn: fqdn=ipa0.<DOMAIN>,cn=computers,cn=accounts,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161721
dn: cn=KDC,cn=ipa0.<DOMAIN>,cn=masters,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161721
dn: cn=KPASSWD,cn=ipa0.<DOMAIN>,cn=masters,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161721
dn: cn=replication managers,cn=sysaccounts,cn=etc,dc=<DOMAIN>
result: 0
changetype: modify
delete: member
member: krbprincipalname=ldap/ipa0.<DOMAIN>@DEV-A.COOL.CYBER.D
 HS.GOV,cn=services,cn=accounts,dc=<DOMAIN>
-
replace: modifiersName
modifiersName: cn=MemberOf Plugin,cn=plugins,cn=config
-
replace: modifyTimestamp
modifyTimestamp: 20250702161720Z
-
replace: entryusn
entryusn: 210760
-
time: 20250702161721
dn: cn=HTTP,cn=ipa0.<DOMAIN>,cn=masters,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161721
dn: cn=OTPD,cn=ipa0.<DOMAIN>,cn=masters,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161722
dn: cn=KEYS,cn=ipa0.<DOMAIN>,cn=masters,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161722
dn: cn=replication managers,cn=sysaccounts,cn=etc,dc=<DOMAIN>
result: 0
changetype: modify
delete: member
member: krbprincipalname=ldap/ipa0.<DOMAIN>@DEV-A.COOL.CYBER.D
 HS.GOV,cn=services,cn=accounts,dc=<DOMAIN>
-
replace: modifiersName
modifiersName: cn=MemberOf Plugin,cn=plugins,cn=config
-
replace: modifyTimestamp
modifyTimestamp: 20250702161720Z
-
replace: entryusn
entryusn: 210765
-
time: 20250702161722
dn: cn=CA,cn=ipa0.<DOMAIN>,cn=masters,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161722
dn: cn=ipaservers,cn=hostgroups,cn=accounts,dc=<DOMAIN>
result: 0
changetype: modify
delete: member
member: fqdn=ipa0.<DOMAIN>,cn=computers,cn=accounts,dc=dev-a,d
 c=cool,dc=cyber,dc=dhs,dc=gov
-
replace: modifiersName
modifiersName: cn=MemberOf Plugin,cn=plugins,cn=config
-
replace: modifyTimestamp
modifyTimestamp: 20250702161721Z
-
replace: entryusn
entryusn: 210767
-
time: 20250702161722
dn: cn=KRA,cn=ipa0.<DOMAIN>,cn=masters,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161722
dn: cn=ipaservers,cn=hostgroups,cn=accounts,dc=<DOMAIN>
result: 0
changetype: modify
delete: member
member: fqdn=ipa0.<DOMAIN>,cn=computers,cn=accounts,dc=dev-a,d
 c=cool,dc=cyber,dc=dhs,dc=gov
-
replace: modifiersName
modifiersName: cn=MemberOf Plugin,cn=plugins,cn=config
-
replace: modifyTimestamp
modifyTimestamp: 20250702161721Z
-
replace: entryusn
entryusn: 210769
-
time: 20250702161723
dn: cn=ipa0.<DOMAIN>,cn=masters,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: uid=first.last,cn=users,cn=accounts,dc=<DOMAIN>
time: 20250702161724
dn: cn=dc\3Ddev-a\2Cdc\3Dcool\2Cdc\3Dcyber\2Cdc\3Ddhs\2Cdc\3Dgov,cn=mapping tree,cn=config
result: 0
changetype: modify
replace: nsslapd-referral
nsslapd-referral: ldap://ipa1.<DOMAIN>:389/dc%3Ddev-a%2Cdc%3Dc
 ool%2Cdc%3Dcyber%2Cdc%3Ddhs%2Cdc%3Dgov
-
replace: modifiersname
modifiersname: cn=server,cn=plugins,cn=config
-
replace: modifytimestamp
modifytimestamp: 20250702161724Z
-
time: 20250702161725
dn: cn=o\3Dipaca,cn=mapping tree,cn=config
result: 0
changetype: modify
replace: nsslapd-referral
nsslapd-referral: ldap://ipa1.<DOMAIN>:389/o%3Dipaca
-
replace: modifiersname
modifiersname: cn=server,cn=plugins,cn=config
-
replace: modifytimestamp
modifytimestamp: 20250702161725Z
-
time: 20250702161725
dn: cn=ipa0.<DOMAIN>-to-ipa1.<DOMAIN>,cn=domain,cn=topology,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: modify
replace: ipaReplTopoSegmentStatus
ipaReplTopoSegmentStatus: removed
-
replace: modifiersName
modifiersName: cn=IPA Topology Configuration,cn=plugins,cn=config
-
replace: modifyTimestamp
modifyTimestamp: 20250702161723Z
-
replace: entryusn
entryusn: 210790
-
time: 20250702161725
dn: cn=ipa0.<DOMAIN>-to-ipa1.<DOMAIN>,cn=domain,cn=topology,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: krbprincipalname=ldap/ipa1.<DOMAIN>@<DOMAIN>,cn=services,cn=accounts,dc=<DOMAIN>
time: 20250702161725
dn: cn=ipa0.<DOMAIN>-to-ipa1.<DOMAIN>,cn=ca,cn=topology,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: modify
replace: ipaReplTopoSegmentStatus
ipaReplTopoSegmentStatus: removed
-
replace: modifiersName
modifiersName: cn=IPA Topology Configuration,cn=plugins,cn=config
-
replace: modifyTimestamp
modifyTimestamp: 20250702161723Z
-
replace: entryusn
entryusn: 210793
-
time: 20250702161725
dn: cn=ipa0.<DOMAIN>-to-ipa1.<DOMAIN>,cn=ca,cn=topology,cn=ipa,cn=etc,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: krbprincipalname=ldap/ipa1.<DOMAIN>@<DOMAIN>,cn=services,cn=accounts,dc=<DOMAIN>
time: 20250702161725
dn: cn=repl keep alive 15,dc=<DOMAIN>
result: 0
changetype: delete
modifiersname: krbprincipalname=ldap/ipa1.<DOMAIN>@<DOMAIN>,cn=services,cn=accounts,dc=<DOMAIN>
time: 20250702161749
dn: fqdn=ipa2.<DOMAIN>,cn=computers,cn=accounts,dc=<DOMAIN>
result: 0
changetype: modify
replace: krbLastSuccessfulAuth
krbLastSuccessfulAuth: 20250702161749Z
-
replace: modifiersname
modifiersname: cn=Directory Manager
-
replace: modifytimestamp
modifytimestamp: 20250702161749Z
-
replace: entryusn
entryusn: 210801
-
time: 20250702161816
dn: cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca
result: 0
changetype: modify
replace: crlSize
crlSize: 0216
-
replace: revokedCerts
revokedCerts:: rO0ABXNyABNqYXZhLnV0aWwuSGFzaHRhYmxlE7sPJSFK5LgDAAJGAApsb2FkRmF
 jdG9ySQAJdGhyZXNob2xkeHA/QAAAAAAAAncIAAAAAwAAAAB4
-
replace: unrevokedCerts
unrevokedCerts:: rO0ABXNyABNqYXZhLnV0aWwuSGFzaHRhYmxlE7sPJSFK5LgDAAJGAApsb2FkR
 mFjdG9ySQAJdGhyZXNob2xkeHA/QAAAAAAAAncIAAAAAwAAAAB4
-
replace: expiredCerts
expiredCerts:: rO0ABXNyABNqYXZhLnV0aWwuSGFzaHRhYmxlE7sPJSFK5LgDAAJGAApsb2FkRmF
 jdG9ySQAJdGhyZXNob2xkeHA/QAAAAAAAAncIAAAAAwAAAAB4
-
replace: firstUnsaved
firstUnsaved: -1
-
replace: modifiersname
modifiersname: uid=pkidbuser,ou=People,o=ipaca
-
replace: modifytimestamp
modifytimestamp: 20250702161816Z
-
replace: entryusn
entryusn: 210805
-
time: 20250702161828
dn: fqdn=guac.env0.<DOMAIN>,cn=computers,cn=accounts,dc=<DOMAIN>
result: 0
changetype: modify
replace: krbLastSuccessfulAuth
krbLastSuccessfulAuth: 20250702161828Z
-
replace: modifiersname
modifiersname: cn=Directory Manager
-
replace: modifytimestamp
modifytimestamp: 20250702161828Z
-
replace: entryusn
entryusn: 210809
-
time: 20250702162226
dn: cn=34983601001,ou=certificateRepository, ou=ca,o=ipaca
result: 0
changetype: modify
add: revInfo
revInfo: 20250702162226Z;CRLReasonExtension=5
-
add: revokedBy
revokedBy: ipara
-
add: revokedOn
revokedOn: 20250702162226Z
-
replace: certStatus
certStatus: REVOKED
-
replace: dateOfModify
dateOfModify: 20250702162226Z
-
replace: modifiersname
modifiersname: uid=pkidbuser,ou=People,o=ipaca
-
replace: modifytimestamp
modifytimestamp: 20250702162226Z
-
replace: entryusn
entryusn: 210836
-
time: 20250702162226
dn: cn=MasterCRL,ou=crlIssuingPoints,ou=ca,o=ipaca
result: 0
changetype: modify
replace: firstUnsaved
firstUnsaved: 79990001
-
replace: modifiersname
modifiersname: uid=pkidbuser,ou=People,o=ipaca
-
replace: modifytimestamp
modifytimestamp: 20250702162226Z
-
replace: entryusn
entryusn: 210837
-
time: 20250702162227
dn: cn=79990001,ou=ca,ou=requests,o=ipaca
result: 0
changetype: add
objectClass: top
objectClass: request
objectClass: extensibleObject
requestId: 0879990001
requestState: complete
dateOfCreate: 20250702162226Z
dateOfModify: 20250702162226Z
extdata-profileapprovedby: system
extdata-profile: true
extdata-requestversion: 1.0.0
extdata-dbstatus: UPDATED
extdata-requeststatus: complete
extdata-isencryptioncert: false
extdata-cert--005finfo;0: MCQCBQglL2NpFw0yNTA3MDIxNjIyMjZaMAwwCgYDVR0VBAMKAQU=
extdata-result: 1
extdata-requestid: 79990001
extdata-req--005fseq--005fnum: 0
extdata-revocationreason: 5
extdata-old--005fcerts;0:: TUlJRnFqQ0NCQktnQXdJQkFnSUZDQ1V2WTJrd0RRWUpLb1pJaHZ
 <cert>
extdata-requestortype: Agent
extdata-updatedby: ipara
extdata-requesttype: revocation
requestType: revocation
cn: 79990001
creatorsName: uid=pkidbuser,ou=People,o=ipaca
modifiersName: uid=pkidbuser,ou=People,o=ipaca
createTimestamp: 20250702162226Z
modifyTimestamp: 20250702162226Z
time: 20250702162227
dn: ou=ca, ou=requests,o=ipaca
result: 0
changetype: modify
replace: publishingStatus
publishingStatus: 79990001
-
replace: modifiersname
modifiersname: uid=pkidbuser,ou=People,o=ipaca
-
replace: modifytimestamp
modifytimestamp: 20250702162227Z
-
replace: entryusn
entryusn: 210839
-
time: 20250702162227
dn: ou=ca, ou=requests,o=ipaca
result: 0
changetype: modify
replace: publishingStatus
publishingStatus: -1
-
replace: modifiersname
modifiersname: uid=pkidbuser,ou=People,o=ipaca
-
replace: modifytimestamp
modifytimestamp: 20250702162227Z
-
replace: entryusn
entryusn: 210840
-
time: 20250702162228
dn: cn=34983601002,ou=certificateRepository, ou=ca,o=ipaca
result: 0
changetype: modify
add: revInfo
revInfo: 20250702162228Z;CRLReasonExtension=5
-
add: revokedBy
revokedBy: ipara
-
add: revokedOn
revokedOn: 20250702162228Z
-
replace: certStatus
certStatus: REVOKED
-
replace: dateOfModify
dateOfModify: 20250702162228Z
-
replace: modifiersname
modifiersname: uid=pkidbuser,ou=People,o=ipaca
-
replace: modifytimestamp
modifytimestamp: 20250702162228Z
-
replace: entryusn
entryusn: 210845
-
time: 20250702162228
dn: cn=79990002,ou=ca,ou=requests,o=ipaca
result: 0
changetype: add
objectClass: top
objectClass: request
objectClass: extensibleObject
requestId: 0879990002
requestState: complete
dateOfCreate: 20250702162228Z
dateOfModify: 20250702162228Z
extdata-profileapprovedby: system
extdata-profile: true
extdata-requestversion: 1.0.0
extdata-dbstatus: UPDATED
extdata-requeststatus: complete
extdata-isencryptioncert: false
extdata-cert--005finfo;0: MCQCBQglL2NqFw0yNTA3MDIxNjIyMjhaMAwwCgYDVR0VBAMKAQU=
extdata-result: 1
extdata-requestid: 79990002
extdata-req--005fseq--005fnum: 0
extdata-revocationreason: 5
extdata-old--005fcerts;0:: TUlJRnl6Q0NCRE9nQXdJQkFnSUZDQ1V2WTJvd0RRWUpLb1pJaHZ
 <cert>
extdata-requestortype: Agent
extdata-updatedby: ipara
extdata-requesttype: revocation
requestType: revocation
cn: 79990002
creatorsName: uid=pkidbuser,ou=People,o=ipaca
modifiersName: uid=pkidbuser,ou=People,o=ipaca
createTimestamp: 20250702162228Z
modifyTimestamp: 20250702162228Z
time: 20250702162228
dn: ou=ca, ou=requests,o=ipaca
result: 0
changetype: modify
replace: publishingStatus
publishingStatus: -1
-
replace: modifiersname
modifiersname: uid=pkidbuser,ou=People,o=ipaca
-
replace: modifytimestamp
modifytimestamp: 20250702162228Z
-
replace: entryusn
entryusn: 210848
-
time: 20250702162229
dn: cn=34983601003,ou=certificateRepository, ou=ca,o=ipaca
result: 0
changetype: modify
add: revInfo
revInfo: 20250702162229Z;CRLReasonExtension=5
-
add: revokedBy
revokedBy: ipara
-
add: revokedOn
revokedOn: 20250702162229Z
-
replace: certStatus
certStatus: REVOKED
-
replace: dateOfModify
dateOfModify: 20250702162229Z
-
replace: modifiersname
modifiersname: uid=pkidbuser,ou=People,o=ipaca
-
replace: modifytimestamp
modifytimestamp: 20250702162229Z
-
replace: entryusn
entryusn: 210851
-
time: 20250702162230
dn: cn=79990003,ou=ca,ou=requests,o=ipaca
result: 0
changetype: add
objectClass: top
objectClass: request
objectClass: extensibleObject
requestId: 0879990003
requestState: complete
dateOfCreate: 20250702162229Z
dateOfModify: 20250702162229Z
extdata-profileapprovedby: system
extdata-profile: true
extdata-requestversion: 1.0.0
extdata-dbstatus: UPDATED
extdata-requeststatus: complete
extdata-isencryptioncert: false
extdata-cert--005finfo;0: MCQCBQglL2NrFw0yNTA3MDIxNjIyMjlaMAwwCgYDVR0VBAMKAQU=
extdata-result: 1
extdata-requestid: 79990003
extdata-req--005fseq--005fnum: 0
extdata-revocationreason: 5
extdata-old--005fcerts;0:: TUlJRVZ6Q0NBcitnQXdJQkFnSUZDQ1V2WTJzd0RRWUpLb1pJaHZ
 <cert>

Did you enable replication of last successful authentication? It is disabled by default.

It is disabled because it can cause extremely heavy replication during busy times like the morning when everyone is logging in.

Did you enable replication of last successful authentication? It is disabled by default.

It is disabled because it can cause extremely heavy replication during busy times like the morning when everyone is logging in.

I think so. After 00_setup_freeipa.sh we run 01_setup_disabling_of_freeipa_users.sh, which runs these commands (among others that I don't think have any bearing here).

01_setup_disabling_of_inactive_freeipa_users.sh is meant to ensure that the FreeIPA cluster has the settings it needs to enable replication of the last successful authentication, plus set up a systemd service and timer to actually disable inactive FreeIPA users.

Also, I can see last authentication timestamps for each of the three servers in the cluster when I run ipa user-status before upgrading. After the upgrade the authentication timestamp information is lost, as if the user had never successfully logged in. This breaks my systemd service since it looks like the user was created X years ago but has never used his or her account.

Edited by jsf9k

This will tell you:

$ ipa config-show |grep plugin
  Password plugin features: AllowNThash, KDC:Disable Last Success

It's enabled then:

[root@ipa1 bin]# ipa config-show | grep plugin
  Password plugin features: AllowNThash

It's clear that the last authentication timestamp for a given user is tracked per FreeIPA server. Are the last authentication timestamps for ipa0, say, actually replicated between FreeIPA servers?

Even assuming that the last authentication timestamps are replicated between FreeIPA servers, would they persist after the ipa server-del command?

By default no, they are not. They are per-server.

In order to allow replication you need to disable the plugin feature (you have) and remove krblastsuccessfulauth from the excluded replication list from every server. And every future server.

This is in the replication agreement. It will look something like:

dn: cn=meToreplica0.ipa.test,cn=replica,cn=dc\3Dipa\2Cdc\3Dtest,cn=mapping tree,cn=config

The attribute is nsDS5ReplicatedAttributeList

You can choose to remove other attributes as you wish just understand that depending on the number of users you have this can come with a pretty significant performance hit.

Every replication agreement contains own list of attributes to be excluded from the replication. By removing a server from the topology, you delete the replication agreement with that server. New agreements created after that step will contain default exclusion list which denies replication of the krbLastSuccessfulAuth attribute as well.

If you need to force replication of the krbLastSuccessfulAuth, then nsDS5ReplicatedAttributeList must be adjusted for each replication agreement. We chose to not allow this by default and consider this not modifiable within IPA itself. There are already means to modify the agreement details within 389-ds management tools, as described in https://docs.redhat.com/en/documentation/red_hat_directory_server/13/html/configuring_and_managing_replication/managing-attributes-within-fractional-replication.

I'm closing this ticket as it is not an issue we can or plan to fix in IPA. For any operational issues please use freeipa-users@ mailing list for further discussion.

Metadata Update from @abbra:
- Issue close_status updated to: invalid
- Issue status updated to: Closed (was: Open)

Thank you @rcritten and @abbra. I think this is indeed the piece I was missing. I am working on implementing these changes now and will report back in a few days.

FWIW, we only have 100-200 users so I am hoping that enabling the replication will not cause a performance issue. In any event, we must track this data across FreeIPA server upgrades to satisfy our security team.
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.