Samba 4.13 considers to deprecate and future versions would remove domain logons setting in smb.conf. This will affect how smbd considers its configuration for non-AD DC setup (NT4 domains mode) which is used by FreeIPA.

looking at lp_find_server_role() and lp_is_security_and_server_role_valid(), we need to define

 server role = CLASSIC PRIMARY DOMAIN CONTROLLER
 security = user

explicitly. Right now we have

 security = user
 domain master = yes
 domain logons = yes

and no server role, so it defaults to AUTO and will require an update of the configuration to set server role explicitly.