[Pkg-freeipa-devel] Interested in contributing to Debian FreeIPA support

[Timo Aaltonen]

Jonathan Aquilina kirjoitti 29.4.2026 klo 19.14:
> Hi Debian FreeIPA Team,
> My name is Jonathan. I am interested in helping improve FreeIPA support 
> on Debian, especially around building, testing, and documenting the 
> server-side pieces on unstable/experimental.
> I have a number of projects where I plan to use FreeIPA as a core 
> identity and authentication mechanism, and I would love to work towards 
> better FreeIPA support in future Debian releases.
> My initial plan is to build and test it on my Debian development laptop, 
> document any failures, test install paths, and contribute small merge 
> requests where useful.
> Is there a preferred starting point, known blocker list, or current area 
> where help would be most useful?
> Regards,
> Jonathan

Hi, thanks for your enthusiasm. Unfortunately, FreeIPA server is 
currently a long way from being useful on Debian.

- 389-ds-base just got updated so that it builds again, but updating 
from 3.1.2 breaks build on at least i386

- dogtag-pki is unavailable, because it didn't support tomcat10 for a 
long time. Now that it finally does since last year, jss first needs 
some work to actually build the tomcatjss bits that got merged to it. 
Then dogtag itself probably needs a heap of work.. Expertise in 
packaging java (maven) apps is a must here, at least for jss

- bind-dyndb-ldap does not support bind9 9.20+, and adding support is 
still WIP upstream:
https://codeberg.org/freeipa/bind-dyndb-ldap/pulls/244

even when it lands, it would be best to bundle with the bind9 upstream, 
which was at least blocked by bind-dyndb-ldap being licensed as GPLv3 
instead of MPL-2:

https://codeberg.org/freeipa/bind-dyndb-ldap/issues/225
(hopefully it'll get merged to upstream bind9 eventually)


And once we have all of these, we can start working on the server 
itself, which has likely changed in ways that require a bunch of 
modifications for Debian..


-- 
t