default.conf(5)

💖 default.conf — the IPA configuration file (manual page default.conf(5))

okay bestie, sit down, hydrate, because this is THE config file for IPA and she has a LOT to say 💅

---

✨ NAME ✨

default.conf — the IPA configuration file. iconic, central, the main character of /etc/ipa 👑

---

✨ SYNOPSIS ✨

/etc/ipa/default.conf, ~/.ipa/default.conf, /etc/ipa/server.conf,
/etc/ipa/cli.conf, /etc/ipa/installer.conf, /etc/ipa/cli_installer.conf

yes bestie, she lives in MULTIPLE places. it's giving "i have a personality for every context" 🦋

---

✨ DESCRIPTION ✨

So. The default.conf configuration file is what you use to set system-wide defaults that get applied whenever IPA clients and servers run. it's the vibe-setter for the whole operation, no cap ✨

Users can also make an optional config file at ~/.ipa/default.conf, and that one gets merged into the system-wide defaults file. a little personal touch, as a treat 🎀

Here's the order the files get read in, and yes, order MATTERS:

• ~/.ipa/default.conf
• /etc/ipa/<context>.conf
• /etc/ipa/default.conf
• built-in constants

The IPA server does not read ~/.ipa/default.conf. not even a little bit. server said "your personal file means nothing to me" 💀

The first setting wins. first come, first served, periodt 💅

---

✨ SYNTAX ✨

the grammar lesson nobody asked for but everybody needs, let's gooo 🌸

The configuration options are not case sensitive. The values, though? Those may be case sensitive, depending on the option. sneaky little guys 😭

Blank lines are ignored. Lines starting with # are comments and get ignored too. ghosted, respectfully 🫶

A valid line is: an option name, an equals sign, and a value. Spaces around the equals sign are ignored. An option terminates at the end of the line. simple. clean. we love a low-drama format ✨

Values should not be quoted — the quotes will not be stripped. like, she will literally keep the quotes as part of the value. do NOT do this to yourself.

# Wrong - don't include quotes
verbose = "True"

# Right - Properly formatted options
verbose = True
verbose=True

see how both right answers work? slay. the wrong one does not. 🙈

Options must appear in the section named [global]. There are no other sections defined or used currently. one section, one vibe, one queen 👑

You can define options that IPA doesn't actually use. ⚠️ but be careful of misspellings — they will not be rejected. she'll just silently ignore your typo and you'll be debugging for three hours fr fr 😭

---

✨ OPTIONS ✨

The following options are relevant for the server:

---

• basedn <base> — Specifies the base DN to use when performing LDAP operations. The base must be in DN format, like dc=example,dc=com. give her the DN or give her nothing 🦋
• ca_agent_port <port> — Specifies the secure CA agent port. The default is 8443.
• ca_host <hostname> — Specifies the hostname of the dogtag CA server. The default is the hostname of the IPA server. she just assumes it's herself unless told otherwise, self-love honestly 💅
• ca_port <port> — Specifies the insecure CA end user port. The default is 8080. note that word "insecure", bestie, she said it not me
• certmonger_wait_timeout <seconds> — The time to wait for a certmonger request to complete during installation. The default value is 300 seconds. To tune it, create/add to /etc/ipa/installer.conf. certmonger is out here taking her sweet time and this is your patience timer ⏳
• context <context> — Specifies the context that IPA is being executed in. IPA may operate differently depending on the context. The current defined contexts are cli, server and dns. Additionally, this value is used to load /etc/ipa/context.conf to provide context-specific configuration. example time: if you want to always perform client requests in verbose mode but do not want verbose enabled on the server, add the verbose option to /etc/ipa/cli.conf. context-specific behavior, we stan a config with range 🌈
• debug <boolean> — When True it provides detailed information. Specifically, this sets the global log level to "debug". Default is False. ⚠️ warning from your girl: this is LOUD. like, screaming into the void loud 🔥
• dogtag_version <version> — Stores the version of Dogtag. Value 9 is assumed if not specified otherwise.
• domain <domain> — The domain of the IPA server, e.g. example.com. give her the domain, she's lost without it 🥺
• enable_ra <boolean> — Specifies whether the CA is acting as an RA agent, such as when dogtag is being used as the Certificate Authority. This setting only applies to the IPA server configuration.
• fallback <boolean> — Specifies whether an IPA client should attempt to fall back and try other services if the first connection fails. backup plan energy, always have a backup plan bestie ✨
• host <hostname> — Specifies the local system hostname.
• http_timeout <seconds> — Timeout for HTTP blocking requests (e.g. connection). The default value is 30 seconds. thirty seconds and then she's GONE 💨
• in_server <boolean> — Specifies whether requests should be forwarded to an IPA server or handled locally. This is used internally by IPA in a similar way as context. The same IPA framework is used by the ipa command-line tool and the server. This setting tells the framework whether it should execute the command as if on the server, or forward it via XML-RPC to a remote server. internal plumbing, iykyk 🚰
• in_tree <boolean> — This is used in development and is generally a detected value. It means that the code is being executed within a source tree. dev girlies know 🌱
• interactive <boolean> — Specifies whether values should be prompted for or not. The default is True. yes queen, ask me questions 🎀
• kinit_lifetime <time duration spec> — Controls the lifetime of the ticket obtained by users authenticating to the WebGUI using login/password. The expected format is a time duration string. Examples are "2 hours", "1h:30m", "10 minutes", "5min, 30sec". When the parameter is not set in default.conf, the ticket will have a duration inherited from the default value for kerberos clients, which can be set as ticket_lifetime in krb5.conf. When the ticket lifetime has expired, the ticket is not valid anymore and the GUI will prompt to re-login with a message "Your session has expired. Please re-login." the ticket dies, the vibe dies, the GUI says please re-login 😭
• ldap_cache <boolean> — Enable a per-request LDAP cache. The default is True. caching, we love her 💅
• ldap_cache_size <integer> — The maximum number of entries cached if ldap_cache is True. Since this cache is per-request it is not expected to be very large. The default is 100. Setting the value < 1 effectively disables the cache regardless of the ldap_cache setting. yes, even if ldap_cache is True. she said what she said
• ldap_cache_debug <boolean> — Log details on hits, misses, etc. for the LDAP cache if the cache is enabled. hit or miss? this option tells you 🔍
• ldap_uri <URI> — Specifies the URI of the IPA LDAP server to connect to. The URI scheme may be one of ldap or ldapi. The default is to use ldapi, e.g. ldapi://%2fvar%2frun%2fslapd-EXAMPLE-COM.socket. look at all those percent signs, she's encoded and she's thriving ✨
• log_logger_XXX <comma separated list of regexps> — Loggers matching the regexp will be assigned XXX level.

Logger levels can be explicitly specified for specific loggers as opposed to a global logging level. Specific loggers are indicated by a list of regular expressions bound to a level. If a logger's name matches the regexp then it is assigned that level. This config item must begin with "log_logger_level_" and then be followed by a symbolic or numeric log level, for example:

log_logger_level_debug = ipalib\.dn\..*

log_logger_level_35 = ipalib\.plugins\.dogtag

The first line says any logger belonging to the ipalib.dn module will have its level configured to debug.

The second line says the ipa.plugins.dogtag logger will be configured to level 35.

This config item is useful when you only want to see the log output from one or more selected loggers. Turning on the global debug flag will produce an enormous amount of output. This allows you to leave the global debug flag off and selectively enable output from a specific logger. Typically loggers are bound to classes and plugins.

Note: logger names are a dot (.) separated list forming a path in the logger tree. The dot character is also a regular expression metacharacter (matches any character), therefore you will usually need to escape the dot in the logger names by preceding it with a backslash. do not skip this, bestie, regex will humble you 💀

• mode <mode> — Specifies the mode the server is running in. The currently supported values are production and developer. When running in production mode some self-tests are skipped to improve performance. production mode said "no time for self-tests, we're busy" ⚡
• mount_ipa <URI> — Specifies the mount point that the development server will register. The default is /ipa/.
• oidc_child_debug_level <debuglevel> — Specifies the debug level of oidc_child, a helper process used by ipa-otpd for OIDC/OAuth2 authentication. Level can be between 0 and 10, the higher the more details. If the level is 6 or higher, HTTP debug output is added as well. crank it to 6 and the HTTP receipts show up 📜
• passkey_child_debug_level <debuglevel> — Specifies the debug level of passkey_child, a helper process used by ipa-otpd for passkey authentication. Level can be between 0 and 10, the higher the more details. If the level is 6 or higher, libfido2 debug output is added as well. same energy, different helper, libfido2 said hi 🔑
• prompt_all <boolean> — Specifies that all options should be prompted for in the IPA client, even optional values. Default is False. turn this on if you want her to ask about EVERYTHING. chatty queen 🗣️
• ra_plugin <name> — Specifies the name of the CA back end to use. The current options are dogtag and none. This is a server-side setting. ⚠️ Changing this value is not recommended, as the CA back end is only set up during initial installation. set it once, set it right, do not come back later fr fr
• realm <realm> — Specifies the Kerberos realm. ALL CAPS energy, usually 🦋
• replication_wait_timeout <seconds> — The time to wait for a new entry to be replicated during replica installation. The default value is 300 seconds. replication is a slow texter, give her five minutes ⏳
• schema_ttl <seconds> — The number of seconds for the ipa tool to cache the IPA API and help schema. Reducing this value during development is helpful so that API changes are seen sooner in the tool. Setting this on a server will define the TTL for all client versions > 4.3.1. Client versions > 4.3.1 that connect to IPA servers older than 4.3.1 will use the client-side configuration value. The default is 3600 seconds. 0 disables the cache. A change in the ttl will not be immediately recognized by clients. They will use the new value once their current cache expires. patience, bestie, the cache has its own timeline 😭
• server <hostname> — Specifies the IPA Server hostname.
• skip_version_check <boolean> — Skip client vs. server API version checking. ⚠️ Can lead to errors/strange behavior when newer clients talk to older servers. Use with caution. this is a "i know what i'm doing" button. do you? 🤨
• startup_timeout <time in seconds> — Controls the amount of time waited when starting a service. The default value is 90 seconds, the same as the default systemd startup timeout. If configuring a CA the startup_timeout value will be added as an override for TimeoutStartSec in systemd. If installation times out when starting the CA, create /etc/ipa/installer.conf with this value set. ninety seconds and if she's not up, she's not coming 😭
• startup_traceback <boolean> — If the IPA server fails to start and this value is True, the server will attempt to generate a python traceback to make identifying the underlying problem easier. when things go wrong, at least you get a nice little paper trail 📜✨

---

and that's the end of part 1, bestie — the server-side options. part 2 has more for you, so don't go anywhere 🫶

• validate_api <boolean> — okay so this one is internal-only, it lives in the IPA source package and its whole job is checking that the API hasn't changed. It's an anti-regression thing 🛡️. If it's True, then some errors get ignored, so that enough of the IPA framework can load up to verify the whole entire API — even if optional components aren't installed. Default is False.
• verbose <boolean> — when True you get more info, bestie. Specifically: it sets the global log level to "info". That's it, that's the whole thing ✨.
• wait_for_dns <number of attempts> — this one controls whether the IPA commands dnsrecord-{add,mod,del} work synchronously or not. The DNS commands will repeat DNS queries up to the number of attempts you specify, until the DNS server returns an up-to-date answer for the modified records. Delay between retries is one second.

The DNS commands will raise a DNSDataMismatch exception if the answer doesn't match the expected value even after all those attempts. 😭

The DNS queries get sent to the resolver configured in /etc/resolv.conf on the IPA server.

Do not enable this in production! 🚨 It will cause problems if the resolver on the IPA server uses a caching server instead of a local authoritative server, or e.g. if DNS answers are modified by DNS64. Default is disabled (the option is not present).

• xmlrpc_uri <URI> — specifies the URI of the XML-RPC server for a client. IPA may use this, and some external tools use it too, like ipa-getcert. Example: https://ipa.example.com/ipa/xml
• jsonrpc_uri <URI> — specifies the URI of the JSON server for a client. IPA uses this one. If you don't give it, it gets derived from xmlrpc_uri. Example: https://ipa.example.com/ipa/json
• rpc_protocol <URI> — specifies what type of RPC calls IPA makes: 'jsonrpc' or 'xmlrpc'. Defaults to 'jsonrpc'. 🎀
• key_type_size TYPE:SIZE — specifies the type and size of private keys for the Apache, LDAP, PKINIT and RA (if you're configuring the CA) certificates. The CA/KRA certificate sizes need to be specified using a pki-config-override file provided to the installer. Currently only supports the RSA key type. Valid type values are: rsa. This only applies during initial server installation. The value gets stored in the IPA config — changing it there will not change existing certificates. It will only apply when a new replica is added. Default is: rsa:2048.

---

The following define the containers for the IPA server. Containers define where in the DIT that objects can be found. The full location is the value of container + basedn. 👑

• container_accounts: cn=accounts
• container_applications: cn=applications,cn=configs,cn=policies
• container_automount: cn=automount
• container_configs: cn=configs,cn=policies
• container_dns: cn=dns
• container_group: cn=groups,cn=accounts
• container_hbac: cn=hbac
• container_hbacservice: cn=hbacservices,cn=hbac
• container_hbacservicegroup: cn=hbacservicegroups,cn=hbac
• container_host: cn=computers,cn=accounts
• container_hostgroup: cn=hostgroups,cn=accounts
• container_netgroup: cn=ng,cn=alt
• container_permission: cn=permissions,cn=pbac
• container_policies: cn=policies
• container_policygroups: cn=policygroups,cn=configs,cn=policies
• container_policylinks: cn=policylinks,cn=configs,cn=policies
• container_privilege: cn=privileges,cn=pbac
• container_rolegroup: cn=roles,cn=accounts
• container_roles: cn=roles,cn=policies
• container_service: cn=services,cn=accounts
• container_sudocmd: cn=sudocmds,cn=sudo
• container_sudocmdgroup: cn=sudocmdgroups,cn=sudo
• container_sudorule: cn=sudorules,cn=sudo
• container_user: cn=users,cn=accounts
• container_vault: cn=vaults,cn=kra
• container_virtual: cn=virtual operations,cn=etc

---

🗂️ FILES 🗂️

• /etc/ipa/default.conf — system-wide IPA configuration file
• $HOME/.ipa/default.conf — user IPA configuration file

Okay so you can also define context-specific configuration files 👀. The context gets set when the IPA api is initialized. The currently defined contexts in IPA are cli, server and dns. This is helpful, for example, if you only want debug enabled on the server and not in the client. If this is set to True in default.conf it will affect both the ipa client tool and the IPA server. If it's only set in server.conf then only the server will have debug set. These files get loaded if they exist:

• /etc/ipa/cli.conf — system-wide IPA client configuration file
• /etc/ipa/server.conf — system-wide IPA server configuration file
• /etc/ipa/installer.conf — IPA configuration used while installing an IPA server or replica
• /etc/ipa/cli_installer.conf — IPA configuration used while installing an IPA client

---

🌸 EXAMPLES 🌸

An example of a context-specific configuration file is /etc/ipa/dns.conf, to be used to increase debug output of the IPA DNSSEC daemons. Obsessed. 🦋

               [global]
           debug = True

---

👀 SEE ALSO 👀

• ipa(1)

---

That's the whole page, bestie — you made it to the end, main character energy fr fr 💅 This one's from the IPA source, dated Feb 21 2011, and it's section default.conf(5). Go forth and configure responsibly, ily 🫶✨