For the past few months I've been porting FreeIPA to FreeBSD in the evenings, and it's now far enough along that I'd like more people to bang on it.
FreeIPA is integrated identity management — think of it as the FreeBSD answer to "where do my users, groups, hosts, Kerberos principals and certificates live". It's not one program but a whole stack: 389 Directory Server (LDAP), an MIT Kerberos KDC, Dogtag PKI as the CA, and an Apache/mod_wsgi layer for the Web UI and API. On Linux this is a well-worn path; on FreeBSD it simply didn't exist.
Where it stands right now on 15-CURRENT/amd64:
https://github.com/joneum/FreeBSD-freeipa-server
What I'm asking for: build it, stand up a server, enroll a client, reboot it, and turn every screw you can find — external CA, custom realm/domain combos, the full
Please file bug reports, results and anything else directly in the GitHub repository (issues on the repo linked above) — that way everything stays in one central place instead of being scattered across the forum. General discussion here is of course fine.
A few honest caveats up front:
FreeIPA is integrated identity management — think of it as the FreeBSD answer to "where do my users, groups, hosts, Kerberos principals and certificates live". It's not one program but a whole stack: 389 Directory Server (LDAP), an MIT Kerberos KDC, Dogtag PKI as the CA, and an Apache/mod_wsgi layer for the Web UI and API. On Linux this is a well-worn path; on FreeBSD it simply didn't exist.
Where it stands right now on 15-CURRENT/amd64:
ipa-server-installruns to completion, all services come up (DS, KDC, kadmin, Dogtag CA, httpd, KDC proxy, OTP daemon)- a FreeBSD client enrolls with
ipa-client-installand resolves IPA users/groups through SSSD - the server survives a reboot and comes back up on its own
https://github.com/joneum/FreeBSD-freeipa-server
What I'm asking for: build it, stand up a server, enroll a client, reboot it, and turn every screw you can find — external CA, custom realm/domain combos, the full
ipa command surface, replicas, uninstall. The uncomfortable paths are the interesting ones.Please file bug reports, results and anything else directly in the GitHub repository (issues on the repo linked above) — that way everything stays in one central place instead of being scattered across the forum. General discussion here is of course fine.
A few honest caveats up front:
- Not for production. This is work-in-progress for testing — use a throwaway VM, not anything you care about.
- One thing that trips everyone up:
security/cyrus-sasl2-gssapimust be built with theGSSAPI_MIToption, otherwise the install fails right at the end. Details in the README. - The stack still depends on a few ports whose FreeBSD changes are only just landing in the tree (389-ds-base, Dogtag, slapi-nis, ...), so a plain stock ports tree won't build the server on its own yet. The README explains what you need.
- The client (
net/freeipa-client) needs fixes that are still open as PR 297487 — the patched version is included in the repo.