FreeIPA

Overview

FreeIPA is the open-source identity, policy, and audit system for Linux and Unix estates, sponsored by Red Hat and the upstream for Red Hat Identity Management (IdM). It is GPL-3.0 licensed and active; the GitHub mirror shows the 4.13 series at 4.13.4 as of November 2026. The project site describes the stack it integrates: 389 Directory Server for LDAP, MIT Kerberos, the Dogtag certificate system, DNS through bind-dyndb-ldap, NTP, and SSSD on clients, managed through a CLI, web UI, and JSON-RPC and XML-RPC APIs, with multi-master replication.

What it is good at

Centralizing Linux identity the way Active Directory centralizes Windows. Users, groups, hosts, and services live in one directory; client hosts enroll and authenticate through SSSD; Kerberos gives users single sign-on to SSH and other services; and access policies, sudo rules, SELinux mappings, and automount are defined centrally rather than per box. The integrated CA issues host and service certificates, and a cross-forest trust with Active Directory lets AD users log in to Linux hosts without duplicate accounts.

Authentication options go beyond passwords. FreeIPA supports OTP tokens (see TOTP), RADIUS, smart cards, and delegation to an external OAuth 2.0 identity provider through the device authorization flow. The 4.11 release added FIDO2 passkeys (initially physical security keys only, with SSSD 2.9.1 or later) and resource-based constrained delegation for Kerberos services. The 4.13 release added DNS over TLS and HTTPS between clients and IdM DNS, LDAP system accounts, random certificate serial numbers by default, full 32-bit ID ranges, and a beta modern web UI; it also disables the compat tree and NIS by default.

Where it falls short

It is infrastructure identity, not web SSO or CIAM. FreeIPA does not act as a SAML or OIDC provider for SaaS apps; teams usually pair it with Keycloak, whose admin guide documents SSSD and FreeIPA user federation. It is self-hosted, so you own replication topology, CA health, backups, and upgrades. Treat it as a tier-zero system like a domain controller: the 4.13.4 release notes fix CVE-2026-76578, where an unauthenticated LDAP client could create a self-managed OTP token for an attacker-chosen principal, a step toward administrator access, and CVE-2026-79678 in idp-add. Patch fast and watch for Kerberos delegation abuse as you would in AD.

Pricing

Free and open source under GPL-3.0. Commercial support comes through Red Hat Identity Management, which Red Hat describes as a component of RHEL, installable on any RHEL server with a valid subscription, rather than a separately licensed product.

Best for, and who should look elsewhere

Choose FreeIPA to give a Linux or Unix fleet central accounts, Kerberos SSO, sudo and host access policy, and an internal CA, often alongside an AD forest. Look elsewhere for web and SaaS SSO (Keycloak, Zitadel), for a cloud directory with device management (JumpCloud), or for a vendor-run service with an SLA.

Bottom line

FreeIPA is the mature, actively maintained open-source answer to "Active Directory for Linux." Run it with the same care as a domain controller.