Forge Home


Manages IPA servers and clients.


725 latest version

5.0 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 6.0.0 (latest)
  • 5.0.2
  • 5.0.1
  • 5.0.0
  • 4.3.0
  • 4.2.0
  • 4.1.1
  • 4.1.0
  • 4.0.0
  • 3.0.1
  • 3.0.0
  • 2.1.0
  • 2.0.1
  • 2.0.0
released Sep 24th 2022
This version is compatible with:
  • Puppet Enterprise 2023.2.x, 2023.1.x, 2023.0.x, 2021.7.x, 2021.6.x, 2021.5.x, 2021.4.x, 2021.3.x, 2021.2.x, 2021.1.x, 2021.0.x, 2019.8.x, 2019.7.x, 2019.5.x, 2019.4.x, 2019.3.x, 2019.2.x, 2019.1.x, 2019.0.x
  • Puppet >= 6.0.0 < 8.0.0
  • ,
  • manage_admin

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'adullact-freeipa', '6.0.0'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add adullact-freeipa
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install adullact-freeipa --version 6.0.0

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.



adullact/freeipa — version 6.0.0 Sep 24th 2022

Freeipa Puppet module

Table of Contents

  1. Description
  2. Setup - The basics of getting started with Freeipa Puppet Module
  3. Usage - Configuration options and additional functionality
  4. Limitations - OS compatibility, etc.
  5. Development - Release Notes


This module will install and configure FreeIPA servers, replicas, and clients.


What Freeipa Pupppet module affects

The module should not affect a previous installation of FreeIPA, it should fail trying.

Below are all items that module can affect:

  • Modifiy /etc/hosts (if $freeipa::manage_host_entry true)

  • Install the following packages if not present: autofs, bind-dyndb-ldap, epel-release, sssd-common, sssdtools, ipa-client, ipa-server, ipa-server-dns, openldap-clients

Installation of Freeipa server will obviously install a ntp server, a DNS server, a LDAP Directory, a Kerberos server, apache, Certmonger and PKI Tomcat.

Setup Requirements

Requirements are given in metadata.jsonfile.

How does the module work.

Usually with a module, the desired state is described. If a value of parameter is changed, then during the next puppet run the node is modified to reach the desired state. But, the module is more an idempotent installer of FreeIPA. So changing a value of parameter does not change the value on the node.


Examples of usage:

Deploy an IPA master :

class {'freeipa':
    ipa_role                    => 'master',
    domain                      => 'example.lan',
    ipa_server_fqdn             => 'ipa-server-1.example.lan',
    puppet_admin_password       => 'secret_abc',
    directory_services_password => 'secret_dir',
    install_ipa_server          => true,
    ip_address                  => '',
    enable_ip_address           => true,
    enable_hostname             => true,
    manage_host_entry           => true,
    install_epel                => true,
    ipa_master_fqdn             => 'ipa-server-1.example.lan',

Add a replica:

The initial password of admin user have expiration set to 3 months. So, if the expiration is not handled and a replica is deployed after this limit, it is impossible to get kerberos TGT. And so the replica deployment fail (Note: the installer send an error message about network issue).

class {'freeipa':
    ipa_role             => 'replica',
    domain               => 'example.lan',
    ipa_server_fqdn      => 'ipa-server-2.example.lan',
    domain_join_password => 'vagrant123',
    install_ipa_server   => true,
    ip_address           => '',
    enable_ip_address    => true,
    enable_hostname      => true,
    manage_host_entry    => true,
    install_epel         => true,
    ipa_master_fqdn      => 'ipa-server-1.example.lan',

Add a client:

class {'freeipa':
    ipa_role                    => 'client',
    domain                      => 'example.lan',
    password_usedto_joindomain  => 'vagrant123',
    install_epel                => true,
    directory_services_password => 'vagrant123',
    ipa_master_fqdn             => 'ipa.example.lan',
    puppet_admin_password       => 'vagrant123',
    ip_address                  => $ipaddress,
    ipa_master_fqdn             => 'ipa-server-1.example.lan',

Create an admin account with task :

bolt task run freeipa::manage_admin operator_login='mylogin' operator_password='mysecret' ensure='present' login='jaimarre' firstname='Jean' lastname='Aimarre' password='newadminsecret' --nodes <ipamaster> --modulepath ~/modules

Delete an admin account with task :

bolt task run freeipa::manage_admin operator_login='mylogin' operator_password='mysecret' ensure='absent' login='jaimarre' --nodes <ipamaster> --modulepath ~/modules


A full description can be found in


This module will not work well if managed passwords contain ' or \. They must be banned.

To deploy a server is only supported on CentOS 7.

Acceptance tests are done :

  • with last available versions of Puppet 6 and Puppet 7 from puppetlabs packages All In One.

  • with CentOS 7 for FreeIPA master and replica nodes. IPA masters and replicas works only on Centos >= 7.5.

  • with Ubuntu 18.06 for FreeIPA clients .

With follwoing issue not fixed the acceptance tests about tasks are disabled : PR :


Home at URL

Issues and MR are welcome. gives some guidance about contributing process. If you follow these contributing guidelines your patch will likely make it into a release a little more quickly.

Release Notes

Details in Key points :

  • release 1.6.1 : the fist release under adullact name space. nothing special.

  • releases 2.x : use code ready for Puppet 4.10 and 5.x, uses pdk as guidance, enable acceptance tests, rename classes from easy_ipa to freeipa.

  • releases 3.x : use public and private classes, enable Puppet 6 tests, drop Puppet 4 tests, refactor module to permit management of administrator accounts.

  • releases 4.x : some cleanup of unused code, updates depencies and install CA on replica by default.

  • releases 5.x : managment of admin accounts are moved from manifests to tasks.


Original work from Harvard University Information Technology, mainly written by Rob Ruma (

then forked by John Puskar (

then forked by ADULLACT ( written by :

  • ADULLACT with Fabien Combernous
  • with Scott Barthelemy and Bertrand RETIF


This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program.  If not, see <>.