Configuration
Global defaults, including search limits, default shell, home, group and e-mail domain for new users, default authentication type, user and group object classes, the SELinux user list, CA renewal and PKINIT masters. Changes affect objects created afterwards.
This page covers the Configuration page under IPA Server. It holds the directory's global settings (ipa config-show). Most fields are defaults for new objects: changing the default shell leaves existing users alone. All IPA servers share the one copy.
Search options
| Field | Default | Meaning |
|---|---|---|
| Search size limit | 100 | Maximum rows a list page or ipa *-find returns. Beyond it the list reports a truncated result. ipa *-find --sizelimit=0 is unlimited |
| Search time limit | 2 s | Maximum time for one query |
Past ten thousand users, raise the size limit to 500 or more, or list pages cannot find the later ones; raise the time limit to 5 s alongside.
User options
| Field | Default | Meaning |
|---|---|---|
| User search fields | uid,givenname,sn,telephonenumber,ou,title | Attributes the list search box matches |
| Default e-mail domain | The domain | A new user without an e-mail gets uid@domain |
| Default users group | ipausers | Group every new user joins |
| Home directory base | /home | A new user's home is the base plus the login |
| Default shell | /bin/sh | Shell for new users. Most sites change it to /bin/bash |
| Maximum username length | 32 | None |
| Password expiration notification | 4 days | How many days before expiry clients warn at login |
| Default user authentication type | Password | Used when a user has no authentication type ticked. Setting it to two-factor enforces OTP for everyone |
| Default user objectclasses | top, person, organizationalperson, inetorgperson, inetuser, posixaccount, krbprincipalaux, krbticketpolicyaux, ipaobject, ipasshuser | LDAP object classes new users carry. Changed only when adding custom schema |
| Domain resolution order | Empty | Which domains to try, in order, for a bare username: linux.ipa.test:ad.ipa.test. With it set, AD users can log in without the @ad.ipa.test suffix |
| Migration mode | Off | Users brought in with ipa migrate-ds have no Kerberos keys. On, they are generated at first login; off once migration is done |
| Default subordinate ID | Off | Allocate subordinate IDs to new users automatically |
Group options
| Field | Default | Meaning |
|---|---|---|
| Group search fields | cn,description | Attributes the list search box matches |
| Default group objectclasses | top, groupofnames, nestedgroup, ipausergroup, ipaobject | LDAP object classes new groups carry |
SELinux options
| Field | Meaning |
|---|---|
| SELinux user map order | The $-separated list of SELinux users available to SELinux user maps. Its order breaks ties when several maps match |
| Default SELinux user | Value when no map matches |
Service options
| Field | Meaning |
|---|---|
| Default PAC type | Whether service tickets carry MS-PAC, PAD or nfs:NONE by default. Keep MS-PAC with a trust |
Server options
| Field | Meaning |
|---|---|
| IPA CA renewal master | The one server that renews the CA's own certificates. Move it with ipa config-mod --ca-renewal-master-server= before decommissioning that server |
| IPA masters capable of PKINIT | Read-only list of servers whose KDC can do certificate authentication |
Boundaries
| Topic | Notes |
|---|---|
| Client cache | Changes are written to the directory at once, but client sssd caches keep the old user attributes. Settings such as Domain resolution order need sss_cache -E |
| Factory reset | None on this page. Note the old value before changing one |
| Policy location | Password policy and ticket policy are not here; each has its own page |
Topology
The replication topology between masters, with nodes, segments, the domain and ca suffixes, what a healthy topology looks like, and where replication status is read.
License Activation
The three blocks of the License Activation page, current status, machine fingerprint and .lic upload, what happens on upload and what each failure message means. Tiers and the three enforcement layers are in the install section.