Not able to add a trust to an AD domain in IPA 4.4.90
Steps to Reproduce: 1. Setup IPA and AD servers 2. ipa-adtrust-install 3. ipa trust-add --admin Administrator --password --type=ad
[root@auto-hv-02-guest01 ~]# ipa trust-add adtest2.qe --admin Administrator --password --type=ad Active Directory domain administrator's password: ipa: ERROR: communication with CIFS server was unsuccessful [root@auto-hv-02-guest01 ~]#
[root@auto-hv-02-guest01 ~]# cat /etc/redhat-release Red Hat Enterprise Linux Server release 7.4 Beta (Maipo)
Version: ipa-server-4.4.90-201702262305.el7.x86_64 ipa-server-trust-ad-4.4.90-201702262305.el7.x86_64 ipa-server-common-4.4.90-201702262305.el7.noarch ipa-server-dns-4.4.90-201702262305.el7.noarch samba-4.6.0-0.1.rc3.el7.x86_64 samba-python-4.6.0-0.1.rc3.el7.x86_64 samba-debuginfo-4.6.0-0.1.rc3.el7.x86_64 samba-libs-4.6.0-0.1.rc3.el7.x86_64 samba-client-libs-4.6.0-0.1.rc3.el7.x86_64 samba-common-tools-4.6.0-0.1.rc3.el7.x86_64 samba-winbind-modules-4.6.0-0.1.rc3.el7.x86_64 samba-client-4.6.0-0.1.rc3.el7.x86_64 samba-common-libs-4.6.0-0.1.rc3.el7.x86_64 samba-winbind-4.6.0-0.1.rc3.el7.x86_64 samba-winbind-clients-4.6.0-0.1.rc3.el7.x86_64 samba-common-4.6.0-0.1.rc3.el7.noarch
======================= Additional info: ======================= [root@auto-hv-02-guest01 ~]# ipa dnsforwardzone-add adtest2.qe --forwarder=10.16.98.175 --forward-policy=only Server will check DNS forwarder(s). This may take some time, please wait ... Zone name: adtest2.qe. Active zone: TRUE Zone forwarders: 10.16.98.175 Forward policy: only
[root@auto-hv-02-guest01 ~]# dig +short SRV _ldap._tcp.adtest2.qe 0 100 389 ipaqa-w2012r2-1.adtest2.qe. [root@auto-hv-02-guest01 ~]# dig +short SRV @10.16.98.175 _ldap._tcp.adtest2.qe 0 100 389 ipaqa-w2012r2-1.adtest2.qe.
[root@auto-hv-02-guest01 ~]# cat /etc/resolv.conf search user2k8r2bos4a2.test nameserver 127.0.0.1
[root@auto-hv-02-guest01 ~]# cat /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6 10.19.34.6 auto-hv-02-guest01.user2k8r2bos4a2.test auto-hv-02-guest01
[root@auto-hv-02-guest01 ~]# cat /etc/named.conf options { // turns on IPv6 for port 53, IPv4 is on by default for all ifaces listen-on-v6 {any;};
// Put files that named is allowed to write in the data/ directory: directory "/var/named"; // the default dump-file "data/cache_dump.db"; statistics-file "data/named_stats.txt"; memstatistics-file "data/named_mem_stats.txt"; // Any host is permitted to issue recursive queries allow-recursion { any; }; tkey-gssapi-keytab "/etc/named.keytab"; pid-file "/run/named/named.pid"; dnssec-enable yes; dnssec-validation no; /* Path to ISC DLV key */ bindkeys-file "/etc/named.iscdlv.key"; managed-keys-directory "/var/named/dynamic";
};
/ If you want to enable debugging, eg. using the 'rndc trace' command, * By default, SELinux policy does not allow named to modify the /var/named directory, * so put the default debug log file in data/ : / logging { channel default_debug { file "data/named.run"; severity dynamic; print-time yes; }; };
zone "." IN { type hint; file "named.ca"; };
include "/etc/named.rfc1912.zones"; include "/etc/named.root.key";
dyndb "ipa" "/usr/lib64/bind/ldap.so" { uri "ldapi://%2fvar%2frun%2fslapd-USER2K8R2BOS4A2-TEST.socket"; base "cn=dns, dc=user2k8r2bos4a2,dc=test"; server_id "auto-hv-02-guest01.user2k8r2bos4a2.test"; auth_method "sasl"; sasl_mech "GSSAPI"; sasl_user "DNS/auto-hv-02-guest01.user2k8r2bos4a2.test"; };
includedir /etc/krb5.conf.d/ includedir /var/lib/sss/pubconf/krb5.include.d/
[logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log
[libdefaults] default_realm = USER2K8R2BOS4A2.TEST dns_lookup_realm = false dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = true udp_preference_limit = 0 default_ccache_name = KEYRING:persistent:%{uid}
[realms] USER2K8R2BOS4A2.TEST = { kdc = auto-hv-02-guest01.user2k8r2bos4a2.test:88 master_kdc = auto-hv-02-guest01.user2k8r2bos4a2.test:88 admin_server = auto-hv-02-guest01.user2k8r2bos4a2.test:749 default_domain = user2k8r2bos4a2.test pkinit_anchors = FILE:/etc/ipa/ca.crt }
[domain_realm] .user2k8r2bos4a2.test = USER2K8R2BOS4A2.TEST user2k8r2bos4a2.test = USER2K8R2BOS4A2.TEST auto-hv-02-guest01.user2k8r2bos4a2.test = USER2K8R2BOS4A2.TEST
[dbmodules] USER2K8R2BOS4A2.TEST = { db_library = ipadb.so }
this is a known issue caused by https://pagure.io/freeipa/issue/6671
I would close this ticket as a duplicate.
Closing as dup of #6671
Metadata Update from @pvoborni: - Custom field tester adjusted to wanted - Issue close_status updated to: duplicate - Issue status updated to: Closed (was: Open)