From Fedora Project Wiki

Revision as of 06:25, 15 April 2013 by Mkosek (talk | contribs)


Leave a FreeIPA domain by deconfiguring it locally.


  1. Verify that your FreeIPA domain access works. If you don't have a FreeIPA domain, you can set one up.
  2. Run through the test case to join the domain.
  3. Verify that you are joined to the domain with the following command
    $ realm list
    Make sure you have a configured: kerberos-member line in the output.
    Note the login-formats: line.
  4. Check that you can resolve domain accounts on the local computer.
    Use the login-formats you saw above, to build a remote user name. It will be in the form of User@FULL-DOMAIN, where FULL-DOMAIN is your full FreeIPA domain name (e.g.
    $ getent passwd ''

How to test

  1. Perform the leave command.
    $ realm leave
    You will be prompted for Policy Kit authorization.
    You will not be prompted for a password.
    This should proceed quickly, not take more that 10 seconds.
    On a successful leave there will be no output.

Expected Results

  1. Check that the domain is no longer configured.
    $ realm list
    Make sure the domain is not listed.
  2. Check that you cannot resolve domain accounts on the local computer.
    $ getent passwd ''
    There should be no output.
  3. Check that there is no machine account for the domain in the keytab.
    sudo klist -k
    You should see no lines referring to the domain in the table, or an error message saying that the keytab does not exist.
  4. If you have console access to a FreeIPA server, you can use the FreeIPA Web UI tool see that the computer account was not deleted.


Use the --verbose argument to see details of what's being done during a leave. Include verbose output in any bug reports.

$ realm leave --verbose

Known Issue [Selinux]: You need to turn off selinux to complete the join. Please do:

$ sudo setenforce 0

Please file all realmd AVC's at this bug:

$ sudo grep realmd /var/log/audit/audit.log