Console overview
What each of the five navigation groups manages, which are controlled by licence modules, and when to use the CLI instead.
The console is at https://<FQDN>/ipa/modern-ui/, user admin. It is a derivative of the FreeIPA web UI: same objects, same API, plus localisation, licence gating and an activation page. The classic UI at https://<FQDN>/ipa/ui remains available for cross-checking.
Pages
Five navigation groups. Groups marked with a module appear only when the licence includes it; unlicensed groups are hidden, not greyed out.
Identity
| Page | Manages | Module |
|---|---|---|
| Users: Active / Stage / Preserved | Three user states. Stage is pre-created and inactive; Preserved is an archive of deleted users that can be restored | – |
| Hosts | Hosts joined to the domain. Capped by the licence; host-add is refused beyond the cap | – |
| Services | Service principals on hosts (HTTP/, ldap/, nfs/…); certificates and keytabs are issued to them | – |
| Groups: User groups / Host groups / Netgroups | Groups. A user group created as "External" maps an AD group | – |
| ID views | Override a user's uid / shell / home on selected hosts without changing the global value | – |
| Automember: User / Host Group Rules | Automatic group membership by attribute | – |
| Subordinate IDs | subuid / subgid allocation for rootless containers | – |
Policy
| Page | Manages | Module |
|---|---|---|
| Host-based access control: rules / services / service groups / test | Who may log in from where to which service on which host. The HBAC test page is available from 1.0.3; ipa hbactest is the CLI equivalent | hbac |
| Sudo: rules / commands / command groups | Central sudo rules, fetched by client sssd | – |
| SELinux user maps | SELinux user by user / host group | – |
| Password policies | Length, history, lockout threshold, per group, with the global policy as fallback | pwpolicy |
| Kerberos ticket policy | Maximum ticket life and renewable life | krb-sso |
Authentication
| Page | Manages | Module |
|---|---|---|
| OTP tokens | Users' TOTP / HOTP tokens | – |
| Identity Provider references | External OIDC identity sources | – |
| Certificate mapping: rules / global config / match | How a client certificate or smart card maps to a user | ca |
Network services
| Page | Manages | Module |
|---|---|---|
| DNS: zones / forward zones / servers / global config | Zones, forwarding and per-server forwarders of the built-in DNS. Meaningless with IPA_SETUP_DNS=false | dns |
| Automount locations | NFS automount locations / maps / keys | automount |
IPA Server
| Page | Manages | Module |
|---|---|---|
| Role-based access control: Roles / Privileges | Delegated administration: who may edit users, who may edit DNS | – |
| Trusts / Trusts global config | AD trust status and ID range type | ad-trust |
| ID ranges | uid / gid ranges for local users and each trusted domain | – |
| Topology / Topology graph | Replication topology between IPA servers | – |
| Configuration | Global defaults: shell, home directory, default group, search limits | – |
| License Activation | Host fingerprint, .lic upload, current licence state | – |
How the licence shapes the console
- Not activated or expired: red banner at the top; every page read-only.
- Activated: navigation groups whose module is not in
modsare hidden. - Expiring within 30 days: yellow banner.
- On the user detail page, the "SSH public keys" block appears only with the ssh-keys module; the "Certificates" block always appears (certificate issuance is in every tier).
To find out why a page is missing, read mods in /var/lib/idmatrix-license/status.json; it is never a browser cache issue.
When to use the CLI
The console covers day-to-day create / read / update / delete. These go through the CLI (ipa commands after kinit admin):
| Task | Command |
|---|---|
| Create the AD trust | ipa trust-add; see AD trust |
| Bulk import | Loop over ipa user-add, or ipa migrate-ds from an existing LDAP |
| Count managed hosts | ipa host-find --sizelimit=0 | tail -1 |
| Add a replica, inspect replication | ipa-replica-install, ipa topologysegment-find |
| Backup and restore | ipa-backup / ipa-restore |
| Full self-check | ipa-healthcheck |
| Simulate an access decision | ipa hbactest --user u --host h --service sshd; the HBAC test page is available from 1.0.3 |
Routine
| Frequency | Task |
|---|---|
| Daily | No red banner in the console; idmatrix-backup.timer ran last night |
| Weekly | Full ipa-backup, copied off-host |
| Monthly | ipa-healthcheck; check the licence expiry date |
| Before changes | Full backup before trust setup, bulk policy edits or upgrades |
Upgrade and backup
Which layers upgrade in place, how, and how to roll back. What the daily backup produces, when to take a full backup, and the difference between restoring to the same machine and a new one.
Users
The three user states, why delete means "move to Preserved", what each block of the detail page holds, and which fields depend on licence modules.