freeipa

#9215 AD sub-domain (sub.foo.bar) trust creation fails from main level Freeipa domain (foo.bar)
Closed: worksforme by abbra. Opened by atol71.

Closed: worksforme
Reopen Issue

Request for enhancement

Ipa user and admin of small network I am queering some issues related to samba AD and Freeipa trust with FQDN's.

If Freeipa is a domain with FQDN and samba or (to my best knowledge) Windows Server is subdomain the IPA-AD trust fails and is not possible to create either from samba or Freeipa side.

samba-tool, Windows Active Directory domains and trusts -tool or IPA www-tool fails to create trust between same domain IPA where AD is sub-domain situation. This has been noted on post at
Freeipa mailing list by by Alexander Bokovoy (RedHat FI.)

Steps to Reproduce

  1. Use any tool to create trust between Freeipa Domain and AD subdomain.

Actual behavior

Domain not found error etc.

Expected behavior

Trust to AD from IPA that is main level domain and trusts sub-level AD domain.

Version/Release/Distribution

Latest docker: https://hub.docker.com/r/freeipa/freeipa-server

Additional info:

NAN (divided by anything is equal to?)

Please provide exact logs that demonstrate the problem

Hi,

Could you tip on what log to read under /var/log on ipa server? Only
info I get is 'Internal error occurred' on web UI.

SH

On 04/08/2022 18:06, Alexander Bokovoy wrote:

abbra added a new comment to an issue you are following:
Please provide exact logs that demonstrate the problem

To reply, visit the link below or just reply to this email
https://pagure.io/freeipa/issue/9215

See details in https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/installing_identity_management/installing-trust-between-idm-and-ad_installing-identity-management#assembly_troubleshooting-setting-up-a-cross-forest-trust_installing-trust-between-idm-and-ad

Hi,

Most obvious reason is port range:

Dynamic RPC

49152-65535

TCP

that is used for RPC calls. I am using a Docker container so now I have
to figure out how to open those ports.

SH

On 05/08/2022 13:57, Alexander Bokovoy wrote:

abbra added a new comment to an issue you are following:
See details inhttps://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/installing_identity_management/installing-trust-between-idm-and-ad_installing-identity-management#assembly_troubleshooting-setting-up-a-cross-forest-trust_installing-trust-between-idm-and-ad

To reply, visit the link below or just reply to this email
https://pagure.io/freeipa/issue/9215

Hi,
Case closed. I had at some point in my Samba AD-DC configuration added attribute userid (clearly stated in samba Wiki to not to do in DC config) for administrator that prevented the trust between samba AD-DC to FreeIPA. It Does not seem to be an issue with port range 49K to 65K though in FreeIPA documentation there is clearly stated that these ports are used.

Thanks, good to hear you solved your issue.

Metadata Update from @abbra:
- Issue close_status updated to: worksforme
- Issue status updated to: Closed (was: Open)

To solve this kind of problem one can do following:

docker exec -it /bin/bash

net conf setparm global 'rpc server dynamic port range' -

and set it to 250 ports that should be adequate for normal use.

ipactl restart
exit

on docker-compose.yml:

ports:
  - "135:135"
  - "138:138"
  - "139:139"
  - "445:445"
  - "1024-1300:1024-1300"
  - "50500-50750:50500-50750" //example of 250 ports for RPC calls
  ...

Tested with smbclient and works.

SH
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.