In a FreeIPA (Identity, Policy, and Audit) environment, security is paramount. To protect systems from brute-force attacks, FreeIPA automatically locks user accounts after a set number of failed login attempts. While this is an excellent security measure, it can create bottlenecks for legitimate users who have simply forgotten their passwords.
You must initialize a Kerberos session before running any ipa utilities. If you do not have an active ticket, the system will reject your command with an unauthorized error.
It is important to differentiate between a locked account and a forgotten password:
