Created attachment 1250036
httpd error_log
I am having a problem with my lab setup (replicates a customer env) in that I
seem to have a problem with the trust established to the AD servers.  This was
previously set up as a two-way trust on ipa 4.3 and was working - I cannot
pinpoint exactly when it broke, but now running ipa 4.4 (AD is 2012r2)
Problem manifests itself in that users in the AD can no longer authenticate to
IdM resources.
[root@auth1 ~]# ipa trust-show ad.home.gatwards.org
  Realm name: ad.home.gatwards.org
  Domain NetBIOS name: AD
  Domain Security Identifier: S-1-5-21-2491084655-2534020579-1020697545
  Trust direction: Two-way trust
  Trust type: Active Directory domain
On the AD side,  nltest /domain_trusts /v   shows a Direct Inbound trust for my
IdM realm
However I am unable to list the trusted domains:
[root@auth1 ~]# ipa trust-fetch-domains ad.home.gatwards.org
ipa: ERROR: AD domain controller complains about communication sequence. It may
mean unsynchronized time on both sides, for example
And trying to re-add (refresh) the trust throws internal error:
[root@auth1 ~]# ipa trust-add --type ad --two-way true ad.home.gatwards.org
--admin Administrator
Active Directory domain administrator's password:
ipa: ERROR: an internal error has occurred
As discussed with Alexander Bokovoy, I removed the trusts from the AD side (mmc
snap-in) and tried again with the same result, catching debug logs of the
issue.