On Sun, 17 Feb 2019, TomK via FreeIPA-users wrote:
Hey All,
Scenario:
Two IPA clusters, both with a unique trust to the same AD DC. One
picks up the private group, the other doesn't. I can login with the
AD user to both:
IPA Cluster 1 (ipa01, ipa02) - a.abc.123
# getent group alex(a)abc.123
alex@abc.123:*:155601104:
#
IPA Cluster 2 (ipa03, ipa04) - b.abc.123
# getent group alex(a)abc.123
#
Curious if anyone ran into the above before and is willing to throw in
a hint or two? Would be appreciated.
You need to start with standard debugging
technique for this case:
- get SSSD debug level set for a domain and nss section on IPA master used
for resolution requests
- issue your request
- collect sssd logs and see what happens
If you have it working on IPA master but not on IPA client, gather the
same amount of logs on both IPA client and IPA master from the same time
frame.
SSSD troubleshooting page is
https://docs.pagure.org/SSSD.sssd/users/troubleshooting.html
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland