FreeIPA

FreeIPA (Identity, Policy and Audit) is an open-source identity management system for Linux and Unix-like environments. It provides centralized authentication, authorization, and account information management, consolidating users, groups, hosts, and policy data in a single, auditable system.

It integrates multiple components to deliver these functions: 389 Directory Server for LDAP directory services, MIT Kerberos for ticket-based authentication, DNS based on Bind, and Dogtag PKI for certificate management. On the client side, SSSD handles authentication and caching, while the IPA server offers a web UI and command-line tools (ipa) for administration. FreeIPA supports host-based access controls (HBAC), sudo rules, SSH public keys distribution, and policy enforcement, with time synchronized by NTP.

Deployment typically uses a primary IPA server with replicas to provide redundancy. Linux hosts are enrolled as IPA clients and obtain identity and policy information from the directory. The project emphasizes Linux-oriented deployment but can interoperate with Windows environments through Kerberos/LDAP and, in some configurations, trust relationships with Active Directory.

History and governance: FreeIPA originated in the Red Hat ecosystem and has since evolved as a community-driven project with Fedora involvement. It is distributed under open-source licenses and supported on major Linux distributions, including Red Hat Enterprise Linux and Fedora, with ongoing development and broader ecosystem tooling.

See also: Kerberos, LDAP, DNS, PKI, SSSD, HBAC.