Issue

when I try to log into a freeipa client thats on a different subnet using AD credentials, I get access denied and dig cannot resolve domain name. However, I can login using AD credential to a freeipa client thats on the same subnet as the freeipa server and windows server. I can see the issue is with DNS but i dont know what to do!

• There are no settings difference between client 1 and 2, All i did was joined freeipa clients and tried to connect using AD credentials
• krb5.conf between the client1 and 2 is exactly same.

freeipa server: 10.10.33.4 [linuxad.com]
AD server: 10.10.33.5 [addomain.com]
Freeipa-client1: 10.10.33.6 [ ad user ssh working]

Freeipa-client2: 10.10.40.5 [ ad user ssh not working]- Firewall OFF

Steps to Reproduce

1. Setup Freeipa - AD trust
2. Have Free IPA and AD server on same subnet
3. Have 1 freeipa client on a different subnet
4. Access freeipa client thats on a different subnet your using AD credentials

Actual behavior

ON Freeipa-client2: 10.10.40.5

1. SSH using AD user: Acess Denied
2. SSH using Freeipa user: working fine
3. Kinit user@addomain.com = kinit: Cannot find KDC for realm "addomain.com" while getting initial credentials
4. dig SRV _ldap._tcp.addomain.com = Refused
5. dig SRV _ldap._tcp.ipadomain.com = NOERROR [ working fine ]
6. id user@addomain.com = working normally, I can view user settings, so i know communication is working
7. secure log shows= pam_sss(sshd:auth): received for user user@addomain.com: 6 (Permission denied)
8. I can login using Freeipa user, but not AD user

Freeipa-client1: 10.10.33.6

• I can login using AD credentials and it is working fine.

Expected behavior

should be able to login using AD credentials

Version/Release/Distribution

ipa-server-4.8.4-7.module_el8.2.0+374+0d2d74a1.x86_64
ipa-client-4.8.4-7.module_el8.2.0+374+0d2d74a1.x86_64
389-ds-base-1.4.2.4-10.module_el8.2.0+489+38ed056a.x86_64
pki-ca-10.8.3-2.module_el8.2.0+371+f5726439.noarch
krb5-server-1.17-18.el8.x86_64

Additional info:

/secure log:
Dec 8 19:16:52 qa sshd[2048]: pam_sss(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.10.34.10 user=aduser@addomain.com
Dec 8 19:16:52 qa sshd[2048]: pam_sss(sshd:auth): received for user aduser@addomain.com: 6 (Permission denied)
Dec 8 19:16:54 qa sshd[2046]: error: PAM: Authentication failure for aduser@addomain.com from 10.10.34.10

/messages:
Dec 8 19:16:52 qa krb5_child[2050][2050]: Cannot find KDC for realm "addomain.com"

Kinit user:
kinit: Cannot find KDC for realm "addomain.com" while getting initial credentials

Dig:
[ansibleadm@qa ~]$ dig SRV _ldap._tcp.addomain.com

; <<>> DiG 9.11.20-RedHat-9.11.20-5.el8 <<>> SRV _ldap._tcp.addomain.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 4838
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 88d963599f422144dff6dd795fd01d7c852a88794e0aafbb (good)
;; QUESTION SECTION:
;_ldap._tcp.addomain.com. IN SRV

;; Query time: 0 msec
;; SERVER: 10.10.33.4#53(10.10.33.55)
;; WHEN: Tue Dec 08 19:42:36 EST 2020
;; MSG SIZE rcvd: 74

krb5_child.log:
(2020-12-08 21:03:49): [krb5_child[2184]] [get_and_save_tgt] (0x0400): Attempting kinit for realm [addomain.com]
(2020-12-08 21:03:49): [krb5_child[2184]] [sss_child_krb5_trace_cb] (0x4000): [2184] 1607479429.246299: Getting initial credentials for user@addomain.com

(2020-12-08 21:03:49): [krb5_child[2184]] [sss_child_krb5_trace_cb] (0x4000): [2184] 1607479429.246301: Sending unauthenticated request

(2020-12-08 21:03:49): [krb5_child[2184]] [sss_child_krb5_trace_cb] (0x4000): [2184] 1607479429.246302: Sending request (166 bytes) to addomain.com

(2020-12-08 21:03:49): [krb5_child[2184]] [sss_child_krb5_trace_cb] (0x4000): [2184] 1607479429.246303: Sending DNS URI query for _kerberos.addomain.com.

(2020-12-08 21:03:49): [krb5_child[2184]] [sss_child_krb5_trace_cb] (0x4000): [2184] 1607479429.246304: No URI records found

(2020-12-08 21:03:49): [krb5_child[2184]] [sss_child_krb5_trace_cb] (0x4000): [2184] 1607479429.246305: Sending DNS SRV query for _kerberos._udp.addomain.com.

(2020-12-08 21:03:49): [krb5_child[2184]] [sss_child_krb5_trace_cb] (0x4000): [2184] 1607479429.246306: Sending DNS SRV query for _kerberos._tcp.addomain.com.

(2020-12-08 21:03:49): [krb5_child[2184]] [sss_child_krb5_trace_cb] (0x4000): [2184] 1607479429.246307: No SRV records found

(2020-12-08 21:03:49): [krb5_child[2184]] [sss_child_krb5_trace_cb] (0x4000): [2184] 1607479429.246308: Retrying AS request with master KDC

(2020-12-08 21:03:49): [krb5_child[2184]] [sss_child_krb5_trace_cb] (0x4000): [2184] 1607479429.246309: Getting initial credentials for user@addomain.com

(2020-12-08 21:03:49): [krb5_child[2184]] [sss_child_krb5_trace_cb] (0x4000): [2184] 1607479429.246311: Sending unauthenticated request

(2020-12-08 21:03:49): [krb5_child[2184]] [sss_child_krb5_trace_cb] (0x4000): [2184] 1607479429.246312: Sending request (166 bytes) to addomain.com (master)

(2020-12-08 21:03:49): [krb5_child[2184]] [sss_child_krb5_trace_cb] (0x4000): [2184] 1607479429.246313: Sending DNS URI query for _kerberos.addomain.com.

(2020-12-08 21:03:49): [krb5_child[2184]] [sss_child_krb5_trace_cb] (0x4000): [2184] 1607479429.246314: No URI records found

(2020-12-08 21:03:49): [krb5_child[2184]] [sss_child_krb5_trace_cb] (0x4000): [2184] 1607479429.246315: Sending DNS SRV query for _kerberos-master._udp.addomain.com.

(2020-12-08 21:03:49): [krb5_child[2184]] [sss_child_krb5_trace_cb] (0x4000): [2184] 1607479429.246316: Sending DNS SRV query for _kerberos-master._tcp.addomain.com.

(2020-12-08 21:03:49): [krb5_child[2184]] [sss_child_krb5_trace_cb] (0x4000): [2184] 1607479429.246317: No SRV records found

(2020-12-08 21:03:49): [krb5_child[2184]] [get_and_save_tgt] (0x0400): krb5_get_init_creds_password returned [-1765328230] during pre-auth.
(2020-12-08 21:03:49): [krb5_child[2184]] [k5c_send_data] (0x0200): Received error code 0
(2020-12-08 21:03:49): [krb5_child[2184]] [pack_response_packet] (0x2000): response packet size: [4]
(2020-12-08 21:03:49): [krb5_child[2184]] [k5c_send_data] (0x4000): Response sent.
(2020-12-08 21:03:49): [krb5_child[2184]] [main] (0x0400): krb5_child completed successfully