#6711 ipa trust-add fails with CIFS server communication error
Closed: duplicate Opened by mvarun.

Not able to add a trust to an AD domain in IPA 4.4.90

Steps to Reproduce:
1. Setup IPA and AD servers
2. ipa-adtrust-install
3. ipa trust-add --admin Administrator --password --type=ad

[root@auto-hv-02-guest01 ~]# ipa trust-add adtest2.qe --admin Administrator --password --type=ad
Active Directory domain administrator's password:
ipa: ERROR: communication with CIFS server was unsuccessful
[root@auto-hv-02-guest01 ~]#

[root@auto-hv-02-guest01 ~]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.4 Beta (Maipo)

Version:
ipa-server-4.4.90-201702262305.el7.x86_64
ipa-server-trust-ad-4.4.90-201702262305.el7.x86_64
ipa-server-common-4.4.90-201702262305.el7.noarch
ipa-server-dns-4.4.90-201702262305.el7.noarch
samba-4.6.0-0.1.rc3.el7.x86_64
samba-python-4.6.0-0.1.rc3.el7.x86_64
samba-debuginfo-4.6.0-0.1.rc3.el7.x86_64
samba-libs-4.6.0-0.1.rc3.el7.x86_64
samba-client-libs-4.6.0-0.1.rc3.el7.x86_64
samba-common-tools-4.6.0-0.1.rc3.el7.x86_64
samba-winbind-modules-4.6.0-0.1.rc3.el7.x86_64
samba-client-4.6.0-0.1.rc3.el7.x86_64
samba-common-libs-4.6.0-0.1.rc3.el7.x86_64
samba-winbind-4.6.0-0.1.rc3.el7.x86_64
samba-winbind-clients-4.6.0-0.1.rc3.el7.x86_64
samba-common-4.6.0-0.1.rc3.el7.noarch

=======================
Additional info:
=======================
[root@auto-hv-02-guest01 ~]# ipa dnsforwardzone-add adtest2.qe --forwarder=10.16.98.175 --forward-policy=only
Server will check DNS forwarder(s).
This may take some time, please wait ...
Zone name: adtest2.qe.
Active zone: TRUE
Zone forwarders: 10.16.98.175
Forward policy: only

[root@auto-hv-02-guest01 ~]# dig +short SRV _ldap._tcp.adtest2.qe
0 100 389 ipaqa-w2012r2-1.adtest2.qe.
[root@auto-hv-02-guest01 ~]# dig +short SRV @10.16.98.175 _ldap._tcp.adtest2.qe
0 100 389 ipaqa-w2012r2-1.adtest2.qe.

[root@auto-hv-02-guest01 ~]# cat /etc/resolv.conf
search user2k8r2bos4a2.test
nameserver 127.0.0.1

[root@auto-hv-02-guest01 ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
10.19.34.6 auto-hv-02-guest01.user2k8r2bos4a2.test auto-hv-02-guest01

[root@auto-hv-02-guest01 ~]# cat /etc/named.conf
options {
// turns on IPv6 for port 53, IPv4 is on by default for all ifaces
listen-on-v6 {any;};

    // Put files that named is allowed to write in the data/ directory:
    directory "/var/named"; // the default
    dump-file               "data/cache_dump.db";
    statistics-file         "data/named_stats.txt";
    memstatistics-file      "data/named_mem_stats.txt";
    // Any host is permitted to issue recursive queries
    allow-recursion { any; };
    tkey-gssapi-keytab "/etc/named.keytab";
    pid-file "/run/named/named.pid";
    dnssec-enable yes;
    dnssec-validation no;
    /* Path to ISC DLV key */
    bindkeys-file "/etc/named.iscdlv.key";
    managed-keys-directory "/var/named/dynamic";

};

/ If you want to enable debugging, eg. using the 'rndc trace' command,
* By default, SELinux policy does not allow named to modify the /var/named directory,
* so put the default debug log file in data/ :
/
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
print-time yes;
};
};

zone "." IN {
type hint;
file "named.ca";
};

include "/etc/named.rfc1912.zones";
include "/etc/named.root.key";

dyndb "ipa" "/usr/lib64/bind/ldap.so" {
uri "ldapi://%2fvar%2frun%2fslapd-USER2K8R2BOS4A2-TEST.socket";
base "cn=dns, dc=user2k8r2bos4a2,dc=test";
server_id "auto-hv-02-guest01.user2k8r2bos4a2.test";
auth_method "sasl";
sasl_mech "GSSAPI";
sasl_user "DNS/auto-hv-02-guest01.user2k8r2bos4a2.test";
};

includedir /etc/krb5.conf.d/
includedir /var/lib/sss/pubconf/krb5.include.d/

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = USER2K8R2BOS4A2.TEST
dns_lookup_realm = false
dns_lookup_kdc = true
rdns = false
ticket_lifetime = 24h
forwardable = true
udp_preference_limit = 0
default_ccache_name = KEYRING:persistent:%{uid}

[realms]
USER2K8R2BOS4A2.TEST = {
kdc = auto-hv-02-guest01.user2k8r2bos4a2.test:88
master_kdc = auto-hv-02-guest01.user2k8r2bos4a2.test:88
admin_server = auto-hv-02-guest01.user2k8r2bos4a2.test:749
default_domain = user2k8r2bos4a2.test
pkinit_anchors = FILE:/etc/ipa/ca.crt
}

[domain_realm]
.user2k8r2bos4a2.test = USER2K8R2BOS4A2.TEST
user2k8r2bos4a2.test = USER2K8R2BOS4A2.TEST
auto-hv-02-guest01.user2k8r2bos4a2.test = USER2K8R2BOS4A2.TEST

[dbmodules]
USER2K8R2BOS4A2.TEST = {
db_library = ipadb.so
}
httpd_error_log.txt


this is a known issue caused by https://pagure.io/freeipa/issue/6671

I would close this ticket as a duplicate.

Closing as dup of #6671

Metadata Update from @pvoborni:
- Custom field tester adjusted to wanted
- Issue close_status updated to: duplicate
- Issue status updated to: Closed (was: Open)

Metadata