Configuration
Global defaults: search limits, default shell / home / group / e-mail domain for new users, default authentication type, user and group object classes, the SELinux user list, CA renewal and PKINIT masters. Changes affect objects created afterwards.
The Configuration page is the directory's global settings (ipa config-show). Most fields are defaults for new objects: changing the default shell leaves existing users alone. All IPA servers share the one copy.
Search options
| Field | Default | Meaning |
|---|---|---|
| Search size limit | 100 | maximum rows a list page or ipa *-find returns; beyond it the list reports a truncated result. ipa *-find --sizelimit=0 is unlimited |
| Search time limit | 2 s | maximum time for one query |
Past ten thousand users raise the size limit to 500 or more, or list pages cannot find the later ones; raise the time limit to 5 s alongside.
User options
| Field | Default | Meaning |
|---|---|---|
| User search fields | uid,givenname,sn,telephonenumber,ou,title | attributes the list search box matches |
| Default e-mail domain | the domain | a new user without an e-mail gets uid@domain |
| Default users group | ipausers | group every new user joins |
| Home directory base | /home | new user's home = base + login |
| Default shell | /bin/sh | shell for new users; most sites change it to /bin/bash |
| Maximum username length | 32 | |
| Password expiration notification | 4 days | how many days before expiry clients warn at login |
| Default user authentication type | password | used when a user has no authentication type ticked. Setting it to two-factor enforces OTP for everyone |
| Default user objectclasses | top, person, organizationalperson, inetorgperson, inetuser, posixaccount, krbprincipalaux, krbticketpolicyaux, ipaobject, ipasshuser | LDAP object classes new users carry; touch only when adding custom schema |
| Domain resolution order | empty | which domains to try, in order, for a bare username: linux.ipa.test:ad.ipa.test. With it set, AD users can log in without the @ad.ipa.test suffix |
| Migration mode | off | users brought in with ipa migrate-ds have no Kerberos keys; leave this on so they are generated at first login, off once migration is done |
| Default subordinate ID | off | allocate subordinate IDs to new users automatically |
Group options
| Field | Default | Meaning |
|---|---|---|
| Group search fields | cn,description | |
| Default group objectclasses | top, groupofnames, nestedgroup, ipausergroup, ipaobject |
SELinux options
| Field | Meaning |
|---|---|
| SELinux user map order | the $-separated list of SELinux users available to SELinux user maps; its order breaks ties when several maps match |
| Default SELinux user | value when no map matches |
Service options
| Field | Meaning |
|---|---|
| Default PAC type | whether service tickets carry MS-PAC, PAD or nfs:NONE by default. Keep MS-PAC with a trust |
Server options
| Field | Meaning |
|---|---|
| IPA CA renewal master | the one server that renews the CA's own certificates. Move it with ipa config-mod --ca-renewal-master-server= before decommissioning that server |
| IPA masters capable of PKINIT | read-only list of servers whose KDC can do certificate authentication |
Boundaries
- Changes are written to the directory at once, but client sssd caches keep the old user attributes; things like domain resolution order need
sss_cache -E. - There is no factory reset on this page; note the old value before changing one.
- Password policy and ticket policy are not here; each has its own page.
Topology
The replication topology between masters: nodes, segments, the domain and ca suffixes, what a healthy topology looks like, and that replication status lives on the CLI.
License Activation
The three blocks of the License Activation page: current status, machine fingerprint, .lic upload; what happens on upload and what each failure message means. Tiers and the three enforcement layers are in the install section.