FreeIPA Directory Server Security

Quick Start

uv tool install eventum-generator
git clone https://github.com/eventum-generator/content-packs.git
cd content-packs
eventum generate \
  --path generators/identity-freeipa-security/generator.yml \
  --id freeipa \
  --live-mode true

Event Types

Realism Features

• About 8,300 records a day from two populations, by UTC hour: people (user logins, administrators, anonymous binds) at 0.017 records/s at 00-07 and 21-24, 0.108 at 07-17 and 0.047 at 17-21; automated clients (lookup accounts, disabled devices, stray connections) at a flat 0.036 records/s. Daily volume varies by about 3%, and the hour curve repeats every day with no weekday cycle.
• 200 users, each with 1-4 of six LDAP-authenticating applications and fixed per-user and per-application weights, make about 4,400 logins a day; the application's address is client_ip. Each attempt is a new connection, op 1 behind StartTLS or op 0. 7% of logins start with 1-6 wrong passwords, retyped after a median of about 20 s in office hours and 28 s at night; 1.2% start with a mistyped user name, and 7% of self-service portal logins are followed on the same connection by a denied modification.
• FreeIPA's default lockout applies to every user account: six failures, each within a minute of the previous one and across all applications, lock it for 10 minutes, and a locked account produces no records until the lock expires (about 7 lockouts a day, 1-15). Only the default global password policy is modelled, with no per-group policies, administrator unlocks or Kerberos failures. ACCOUNT_LOCKED stands for two accounts disabled through nsAccountLock whose devices still try, about 20 bursts of 1-4 a day, not for the lockout.
• Lookup accounts under cn=sysaccounts,cn=etc re-bind about every three minutes, any hour, on 2-4 pooled connections with growing op numbers. About once every two days one application keeps reconnecting with a stale password every ~40 s for a median 25 minutes and its pooled re-binds fail too; service accounts are not locked. About ten Directory Manager sessions a day come from three admin hosts, 20% starting with 1-4 typos, with root_dn true on every attempt. conn_id is one server-wide counter whose step varies with the unlogged GSSAPI connections in between.
• Ordinary traffic holds per day about 20-40 windows of five failures for one DN and address within 10 minutes without a success, 16-31 successes after exactly four wrong passwords and 260-450 wrong-password pairs by the same DN and address within 60 s. It never holds a success after five wrong passwords for the same DN and address within 10 minutes, which a real directory sees from forgetful users, so a detector for the chain has no false positives here; with anomaly mode on, counts of the chain parts are about one per episode higher.
• The layout follows the 389-ds-base main-branch source and two raw lines in the 389 DS design pages; no complete production FreeIPA capture was available, and older 2.x releases may differ (for example an integer utc_time). Only SIMPLE binds: no SIMPLE/MFA, TLSCLIENTAUTH, LDAPI, CERT_MAP_FAILED or HAPROXY_SUCCESS. UTC clocks, one server, IPv4 only; users, applications and rates are training assumptions. No Elastic integration covers this log, and compatibility with the KUMA FreeIPA normalizer is not established.

Sample Output

{
  "@timestamp": "2026-10-02T15:46:14.148Z",
  "ecs": {
    "version": "8.17.0"
  },
  "event": {
    "action": "bind_success",
    "category": [
      "authentication"
    ],
    "dataset": "freeipa.security",
    "kind": "event",
    "module": "freeipa",
    "original": "{ \"date\": \"[02\\/Oct\\/2026:15:46:14.148015846 +0000] \", \"utc_time\": \"1790955974.148015846\", \"event\": \"BIND_SUCCESS\", \"dn\": \"uid=thomas.scott,cn=users,cn=accounts,dc=example,dc=test\", \"bind_method\": \"SIMPLE\", \"root_dn\": false, \"client_ip\": \"10.20.3.13\", \"server_ip\": \"10.20.0.10\", \"ldap_version\": 3, \"conn_id\": 369251, \"op_id\": 1, \"msg\": \"\" }",
    "outcome": "success",
    "type": [
      "start"
    ]
  },
  "freeipa": {
    "security": {
      "bind_method": "SIMPLE",
      "client_ip": "10.20.3.13",
      "conn_id": 369251,
      "dn": "uid=thomas.scott,cn=users,cn=accounts,dc=example,dc=test",
      "event": "BIND_SUCCESS",
      "ldap_version": 3,
      "msg": "",
      "op_id": 1,
      "root_dn": false,
      "server_ip": "10.20.0.10"
    }
  },
  "host": {
    "ip": [
      "10.20.0.10"
    ],
    "name": "ipa-01.example.test"
  },
  "log": {
    "file": {
      "path": "/var/log/dirsrv/slapd-EXAMPLE-TEST/security"
    }
  },
  "related": {
    "ip": [
      "10.20.3.13",
      "10.20.0.10"
    ],
    "user": [
      "thomas.scott"
    ]
  },
  "source": {
    "ip": "10.20.3.13"
  },
  "user": {
    "name": "thomas.scott"
  }
}

Parameters