FreeIPA relies on a number of system users and groups that must be present or created by the corresponding packages:

$ grep -E '(User\("|Group\(")' ipaplatform/base/constants.py 
    IPAAPI_USER = User("ipaapi")
    IPAAPI_GROUP = Group("ipaapi")
    DS_USER = User("dirsrv")
    DS_GROUP = Group("dirsrv")
    HTTPD_USER = User("apache")
    HTTPD_GROUP = Group("apache")
    GSSPROXY_USER = User("root")
    KDCPROXY_USER = User("kdcproxy")
    NAMED_USER = User("named")
    NAMED_GROUP = Group("named")
    PKI_USER = User("pkiuser")
    PKI_GROUP = Group("pkiuser")
    ODS_USER = User("ods")
    ODS_GROUP = Group("ods")
    SSSD_USER = User("sssd")

In Fedora 42, RPM will complain if none of the packages export provides and requires for the system users they create or depend on: https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers

This means that corresponding packages need to own sysusers.d configuration to enable management of these files. FreeIPA itself creates ipaapi and kdcproxy system users and groups and thus needs to be changed.

Since we depend on the rest of those system users/groups to be present, we need to ensure other projects also extend their RPM configuration.