MCP server for FreeIPA identity management
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"bibliocommons-mcp-freeipa","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# FreeIPA MCP Server MCP server for FreeIPA identity management instances. Tools are dynamically registered from FreeIPA's schema API, exposing ~290 commands covering users, groups, hosts, DNS, HBAC, sudo rules, certificates, services, trusts, vaults, and more. The server uses [CodeMode](https://gofastmcp.com/servers/transforms/code-mode#code-mode) for efficient LLM interaction, collapsing ~290 individual tools into 3 meta-tools (`get_tags`, `search`, `get_schemas`) that let AI assistants discover and call commands on demand rather than loading all tools into context at once. Both MCP (stdio) and REST API (Swagger UI) interfaces are available, sharing the same underlying FreeIPA client. ## Configuration **Authentication**: FreeIPA supports two authentication methods: - **Password** — username/password with session cookies (simpler, good for development) - **Kerberos** — keytab-based authentication (recommended for production, no passwords stored) ### Option 1: config.json (Password Auth) ```bash cp config.json.example config.json # Edit config.json with your credentials ``` ```json { "host": "ipa.example.com", "auth_method": "password", "username": "api-user", "password": "changeme", "verify_ssl": true, "ca_cert_path": "/etc/ipa/ca.crt" } ``` ### Option 1b: config.json (Kerberos Auth) ```json { "host": "ipa.example.com", "auth_method": "kerberos", "principal": "mcp-api", "keytab_path": "/root/mcp-api.keytab", "verify_ssl": true, "ca_cert_path": "/etc/ipa/ipa-ca.cert" } ``` The server runs `kinit -kt <keytab_path> <principal>` automatically. No password needed. ### Option 2: Environment Variables ```bash # Password auth export FREEIPA_HOST="ipa.example.com" export FREEIPA_AUTH_METHOD="password" export FREEIPA_USERNAME="api-user" export FREEIPA_PASSWORD="api-password" export FREEIPA_VERIFY_SSL="true" export FREEIPA_CA_CERT_PATH="/etc/ipa/ca.crt" # Or Kerberos auth export FREEIPA_HOST="ipa.example.com" export FREEIPA_AUTH_METHOD=…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.