From Newsgroup: muc.lists.freebsd.ports

Hi,

I've been porting FreeIPA to FreeBSD and it is now far enough along for
a Call For Testing.
FreeIPA is integrated identity management - LDAP + Kerberos + a CA + a
web UI. The whole stack is involved: 389 Directory Server, an MIT
Kerberos KDC, Dogtag PKI (the CA, Java/Tomcat) and an Apache/mod_wsgi management layer.

Status on FreeBSD 15.1/amd64:
- ipa-server-install runs to completion; all services come up
(Directory Server, KDC, kadmin, Dogtag CA, httpd, KDC proxy, ipa-otpd)
- a FreeBSD client enrolls via ipa-client-install and resolves
users/groups through SSSD
- the server survives a reboot and comes back up on its own

All of the dependencies are already committed to the ports tree; the
only two ports not yet in it are net/freeipa-server and
net/freeipa-client themselves. Both of them, together with the
documentation (install, prerequisites, known issues, build notes), are here:

https://github.com/joneum/FreeBSD-freeipa-server

Notes for testers:
- Not for production yet - please use a throwaway VM.
- security/cyrus-sasl2-gssapi must be built with the GSSAPI_MIT option, otherwise the install runs all the way through and then fails at
the very end (SPNEGO / "cannot find KDC"). Details are in the README.
- net/freeipa-client needs the fixes from PR 297487; the patched port
is included in the repo.

Please send test results and bug reports to the GitHub repo so
everything stays in one place. Review of and feedback on the ports
themselves is very welcome as well.

Cheers,
Jochen


--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-admin@muc.de
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: muc.lists.freebsd.ports

On Thu, Aug 13, 2026 at 12:23rC>PM Jochen Neumeister <joneum@freebsd.org> wrote:

https://github.com/joneum/FreeBSD-freeipa-server

That's a lot of patches. Do you plan to upstream?
--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-admin@muc.de
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: muc.lists.freebsd.ports

Very nice :-)-a I am happy to hear this...
Cheers, Norbert
On 8/13/26 11:21, Jochen Neumeister wrote:

Hi,

I've been porting FreeIPA to FreeBSD and it is now far enough along
for a Call For Testing.
FreeIPA is integrated identity management - LDAP + Kerberos + a CA + a
web UI. The whole stack is involved: 389 Directory Server, an MIT
Kerberos KDC, Dogtag PKI (the CA, Java/Tomcat) and an Apache/mod_wsgi management layer.

Status on FreeBSD 15.1/amd64:
-a - ipa-server-install runs to completion; all services come up
-a-a-a (Directory Server, KDC, kadmin, Dogtag CA, httpd, KDC proxy, ipa-otpd)
-a - a FreeBSD client enrolls via ipa-client-install and resolves
-a-a-a users/groups through SSSD
-a - the server survives a reboot and comes back up on its own

All of the dependencies are already committed to the ports tree; the
only two ports not yet in it are net/freeipa-server and
net/freeipa-client themselves. Both of them, together with the
documentation (install, prerequisites, known issues, build notes), are
here:

-a-a-a-ahttps://github.com/joneum/FreeBSD-freeipa-server

Notes for testers:
-a - Not for production yet - please use a throwaway VM.
-a - security/cyrus-sasl2-gssapi must be built with the GSSAPI_MIT-a-a-a-a-a option, otherwise the install runs all the way through and then fails
at the very end (SPNEGO / "cannot find KDC"). Details are in the README.
-a - net/freeipa-client needs the fixes from PR 297487; the patched
port is included in the repo.

Please send test results and bug reports to the GitHub repo so
everything stays in one place. Review of and feedback on the ports themselves is very welcome as well.

Cheers,
Jochen

--
I love penguins at the south pole, windows in my house and apples on my tree, but not in my computer :)
--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-admin@muc.de
--- Synchronet 3.22a-Linux NewsLink 1.2

From Newsgroup: muc.lists.freebsd.ports

On Thu, 13 Aug 2026 at 11:22, Jochen Neumeister <joneum@freebsd.org> wrote:

Hi,

I've been porting FreeIPA to FreeBSD and it is now far enough along for
a Call For Testing.
FreeIPA is integrated identity management - LDAP + Kerberos + a CA + a
web UI. The whole stack is involved: 389 Directory Server, an MIT
Kerberos KDC, Dogtag PKI (the CA, Java/Tomcat) and an Apache/mod_wsgi management layer.

Status on FreeBSD 15.1/amd64:
- ipa-server-install runs to completion; all services come up
(Directory Server, KDC, kadmin, Dogtag CA, httpd, KDC proxy, ipa-otpd)
- a FreeBSD client enrolls via ipa-client-install and resolves
users/groups through SSSD
- the server survives a reboot and comes back up on its own

All of the dependencies are already committed to the ports tree; the
only two ports not yet in it are net/freeipa-server and
net/freeipa-client themselves. Both of them, together with the
documentation (install, prerequisites, known issues, build notes), are here:

https://github.com/joneum/FreeBSD-freeipa-server

Notes for testers:
- Not for production yet - please use a throwaway VM.
- security/cyrus-sasl2-gssapi must be built with the GSSAPI_MIT
option, otherwise the install runs all the way through and then fails at
the very end (SPNEGO / "cannot find KDC"). Details are in the README.
- net/freeipa-client needs the fixes from PR 297487; the patched port
is included in the repo.

Please send test results and bug reports to the GitHub repo so
everything stays in one place. Review of and feedback on the ports
themselves is very welcome as well.

Cheers,
Jochen

Hello,

First of all, as someone who is trying to replace Windows Server in
the company I am working.
Thank you so much for your work.

I'll try to start with the testing next week.

Bye!


--
Posted automagically by a mail2news gateway at muc.de e.V.
Please direct questions, flames, donations, etc. to news-admin@muc.de
--- Synchronet 3.22a-Linux NewsLink 1.2