Overview

Part 3 of the Identity series covers the practical FreeIPA lifecycle: stage users, activation, active users, disabled users, preserved users, restore, groups, nested groups, member managers and the effect on enrolled Linux clients.

The lab used Fedora 44, FreeIPA 4.13.3, SELinux Enforcing, a real Web UI login with a trusted lab CA and CLI/client evidence.

https://ipa01.example.test/ipa/ui/

FreeIPA active users. The screenshot comes from the isolated Fedora 44 / FreeIPA 4.13.3 lab.

Lab Baseline

bash
Server:        ipa01.example.test
Client:        client01.example.test
Domain:        example.test
Realm:         EXAMPLE.TEST
FreeIPA:       4.13.3
SSSD:          2.13.1
SELinux:       Enforcing

Stage Users and Activation

Stage users are prepared accounts that are not yet normal active users. The lab created stage-alpha as a stage user and then activated it. After activation, the user appears in Active Users.

bash
ipa stageuser-add stage-alpha --first Stage --last Alpha
ipa stageuser-activate stage-alpha
ipa user-show stage-alpha --all
https://ipa01.example.test/ipa/ui/

FreeIPA stage users. The screenshot comes from the isolated Fedora 44 / FreeIPA 4.13.3 lab.

https://ipa01.example.test/ipa/ui/

FreeIPA stage-alpha user after activation. The screenshot comes from the isolated Fedora 44 / FreeIPA 4.13.3 lab.

Active and Disabled Users

Active users are visible through FreeIPA, SSSD and Kerberos. A disabled user can still resolve as an identity while authentication is denied. This distinction matters: identity resolution is not authentication permission.

bash
ipa user-add disabled-user --first Disabled --last User
ipa user-disable disabled-user
getent passwd disabled-user
kinit disabled-user
https://ipa01.example.test/ipa/ui/

Disabled FreeIPA user disabled-user. The screenshot comes from the isolated Fedora 44 / FreeIPA 4.13.3 lab.

Preserved Users and Restore

Preserve deletion keeps a user object for restore and audit purposes. The lab left preserved-user visible as a preserved user and restored restored-user.

bash
ipa user-del preserved-user --preserve
ipa user-find preserved-user --preserved=true
ipa user-undel restored-user
https://ipa01.example.test/ipa/ui/

Preserved users in FreeIPA with preserved-user. The screenshot comes from the isolated Fedora 44 / FreeIPA 4.13.3 lab.

https://ipa01.example.test/ipa/ui/

Restored FreeIPA user restored-user. The screenshot comes from the isolated Fedora 44 / FreeIPA 4.13.3 lab.

Groups, Nested Groups and Member Managers

FreeIPA groups are central POSIX groups. In the lab, engineering contains the user life-active and the nested group linux-admins. webadmin is configured as member manager for engineering.

bash
ipa group-add engineering --desc="Engineering users"
ipa group-add linux-admins --desc="Linux administrators"
ipa group-add-member engineering --users life-active
ipa group-add-member engineering --groups linux-admins
ipa group-add-member-manager engineering --users webadmin
https://ipa01.example.test/ipa/ui/

Nested FreeIPA group engineering with linux-admins. The screenshot comes from the isolated Fedora 44 / FreeIPA 4.13.3 lab.

https://ipa01.example.test/ipa/ui/

FreeIPA member manager webadmin for engineering. The screenshot comes from the isolated Fedora 44 / FreeIPA 4.13.3 lab.

Client Evidence

The Web UI shows the FreeIPA state. The important second check is what an enrolled Linux client sees: SSSD resolves identities and groups, Kerberos allows valid logins and negative tests block disabled accounts.

bash
ipa stageuser-add stage-alpha --first Stage --last Alpha
ipa stageuser-activate stage-alpha
ipa user-show stage-alpha --all


Added stage user "stage-alpha"
Stage user stage-alpha activated
User login: stage-alpha
UID: 310200003
GID: 310200003
Account disabled: False
Preserved user: False
bash
getent passwd stage-alpha
id stage-alpha
getent passwd life-active
id life-active


stage-alpha:*:310200003:310200003:Stage Alpha:/home/stage-alpha:/bin/bash
uid=310200003(stage-alpha) gid=310200003(stage-alpha) groups=310200003(stage-alpha)
life-active:*:310200004:310200004:Life Active:/home/life-active:/bin/bash
uid=310200004(life-active) gid=310200004(life-active) groups=310200004(life-active),310200008(engineering)
bash
kinit life-active
klist
ssh life-active@client01.example.test
pwd


Ticket cache: KCM:1001
Default principal: life-active@EXAMPLE.TEST
krbtgt/EXAMPLE.TEST@EXAMPLE.TEST
life-active
/home/life-active
bash
ipa user-disable life-active
kinit life-active
ssh life-active@client01.example.test


kinit: Client's credentials have been revoked while getting initial credentials
DISABLED_KINIT_RC=1
DISABLED_SSH_RC=5

Result Check

Web UI

Check
Login with trusted FreeIPA CA
Expected Result
Browser receives valid ipa_session and /ipa/session/json is authenticated
Status
PASS

Stage user

Check
Create and activate
Expected Result
Stage user becomes active user
Status
PASS

Disable/enable

Check
Disable user and run negative login test
Expected Result
Identity still resolves, authentication is blocked
Status
PASS

Preserved user

Check
Preserve and restore
Expected Result
Preserved user visible, restore works
Status
PASS

Groups

Check
POSIX and nested groups
Expected Result
Groups and nested membership are visible
Status
PASS

Member manager

Check
Delegated group maintenance
Expected Result
Member manager is visible
Status
PASS

Client

Check
SSSD/Kerberos/SSH/negative tests
Expected Result
Client behavior matches FreeIPA state
Status
PASS

Limits of This Part

  • This part covers identity lifecycle, not HBAC, sudo rules, replication, backup or Keycloak.

  • The lab used Fedora 44 with FreeIPA 4.13.3 in an isolated environment.

  • Production environments additionally need role design, backup, monitoring, password policies and change processes.

FreeIPA 2026 Step by Step

Previous part: connecting Linux clients to FreeIPA. We only link a next part once it is published.