freeipa

#9470 Add recognition of IPA to IPA trust to KDB driver
Opened by abbra. Modified

Open
Close Issue

With experimental code in abbra/freeipa:wip-ipa-ipa-trust I can establish trust between two IPA deployments using ipa trust-add command. However, the tickets from one realm aren't accepted by the another one even though the trust is visible:

[root@master1 ~]# ipa trust-find
---------------
1 trust matched
---------------
  Realm name: ipa2.test
  Domain NetBIOS name: IPA2
  Domain Security Identifier: S-1-5-21-3316595794-1135930404-2039284338
  Trust type: Active Directory domain
----------------------------
Number of entries returned 1

Oct 23 09:54:20 master1.ipa1.test krb5kdc[17497](Error): PAC issue: PAC record claims domain SID different to local domain SID or any trusted domain SID: local [S-1-5-21-790702333-3825749031-3739951824], PAC [S-1-5-21-3316595794-1135930404-2039284338]
Oct 23 09:54:20 master1.ipa1.test krb5kdc[17497](info): TGS_REQ : handle_authdata (-1765328364)
Oct 23 09:54:20 master1.ipa1.test krb5kdc[17497](info): TGS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 10.0.197.151: HANDLE_AUTHDATA: authtime 1698053425,  admin@IPA2.TEST for host/master1.ipa1.test@IPA1.TEST, TGT has been revoked
Oct 23 09:54:20 master1.ipa1.test krb5kdc[17497](info): closing down fd 11
Oct 23 09:54:20 master1.ipa1.test krb5kdc[17497](Error): PAC issue: PAC record claims domain SID different to local domain SID or any trusted domain SID: local [S-1-5-21-790702333-3825749031-3739951824], PAC [S-1-5-21-3316595794-1135930404-2039284338]
Oct 23 09:54:20 master1.ipa1.test krb5kdc[17497](info): TGS_REQ : handle_authdata (-1765328364)
Oct 23 09:54:20 master1.ipa1.test krb5kdc[17497](info): TGS_REQ (6 etypes {aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), camellia256-cts-cmac(26), camellia128-cts-cmac(25)}) 10.0.197.151: HANDLE_AUTHDATA: authtime 1698053425,  admin@IPA2.TEST for host/master1.ipa1.test@IPA1.TEST, TGT has been revoked
Oct 23 09:54:20 master1.ipa1.test krb5kdc[17497](info): closing down fd 11
Metadata
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.