On pe, 16 maalis 2018, lejeczek via FreeIPA-users wrote:
On 08/03/18 13:39, lejeczek via FreeIPA-users wrote:
>hi guys
>I'm trying to add a trust to AD, I do DNS regural(as per Win
>Integration Guide) and all seems good, but it fails with error as
>per the subject.
>
>With regards to DNS, only thing on the odd side (guide mentions this
>record) is missing
_kerberos._udp.dc._msdcs.ad.example.com
>Would this be a problem.
>
>I also use --server to trust-add but it fails the same.
>
>How to troubleshoot it? ipa -v also does not reveal more.
>Process asks:
>
>Active Directory domain administrator's password:
>
>and the fails immediately.
>many thanks, L.
anybody, guys?
it's strange for I reboot win server and once it complains about
"..RPC connection to the Active Directory Domain controller ipa1.."
after the reboot it would complain about ".. ipa2....".
And certainly both ipa hosts are dns resolvable and up & running and
seem okey.
We aren't implementing full AD functionality in FreeIPA. Thus,
certain
flows aren't accessible from AD side. This is why we do not run trust
validation from AD DC side but rather trigger it via RPC calls from IPA
side when trust is established. This, however, only possible when you
are using admin credentials, not shared secret.
So what you see is expected.
--
/ Alexander Bokovoy