Thomas Woerner

The admin password can be set with the `user` module `ipa user-mod`. For the dm password there is more to do. Here is a (outdated) guide from freeipa.org: https://www.freeipa.org/page/Howto/Change_Directory_Manager_Password and...

The admin password change will be replicated to the whole domain, the change of the dm password needs to be done on all servers/replicas.

Only if `ipaclient_get_otp` is enabled to generate the OTP automatically, it is required to connect to be able to a server of the domain (to generate the OTP). It might...

I think we need to switch to 2.13 for now: https://docs.ansible.com/ansible/latest/reference_appendices/release_and_maintenance.html#ansible-core-support-matrix Ansible core 2.13 will be EOL 06 Nov 2023.

I think we should switch to 2.13 for now and in November to 2.14.

Please change the minimum required version to `>= 2.15.0`.

Which IPA version are you using?

certmonger_wait_timeout is defined within `ipalib/constants.py` and used within the server and certmonger installation code. ansible-freeipa is not using certmonger_wait_timeout itself.

Is the server also using 4.9.11?

Please run this on the client machines: ``` rpm -qf $(python -c "import ipaclient; print(ipaclient.__path__[0])") rpm -qf $(/usr/libexec/platform-python -c "import ipaclient; print(ipaclient.__path__[0])") ``` The first line is for RHEL-7 and...