Hi Alexander,
I followed your instructions, and this is how far I got:
1. User is listed on the IPA server under: Identity > ID Views > Default Trust
View:
bezu(a)ourdomain.local
2. SSH to the client using my AD credentials
3. I run:
$ kinit bezu(a)example.local
Password for bezu(a)ourdomain.local:
4. Generated key and CSR using openssl > myreq.csr
5. Run:
$ ipa cert-request myreq.csr
Principal: bezu(a)ourdomain.local
ipa: ERROR: The realm for the principal does not match the realm for this IPA server.
$ klist
Ticket cache: KCM:176...1680:95288
Default principal: bezu(a)OURDOMAIN.LOCAL
Valid starting Expires Service principal
26/02/22 03:12:04 26/02/22 13:04:54 HTTP/ca.idm.ourdomain.local(a)IDM.OURDOMAIN.LOCAL
26/02/22 03:04:54 26/02/22 13:04:54 krbtgt/OURDOMAIN.LOCAL(a)OURDOMAIN.LOCAL
renew until 01/03/22 03:04:45
26/02/22 03:12:04 26/02/22 13:04:54 krbtgt/IDM.OURDOMAIN.LOCAL(a)OURDOMAIN.LOCAL
Where idm.ourdmoain.local is the IPA server; ca.idm.ourdomain.local is the client;
OURDMAIN.LOCAL is our AD domain.
Is this the error you were expecting?
I don't fully understand the error message. Does it have to do with the CSR? The
Subject contains the same O= as the IPA Server... Does it need a specific format?
The Sub-CA has the following Subject:
CN=VPN CA,O=Company Name,O=OURDMAIN.LOCAL,ST=OurRegion, L = OurLocality
And the CSR:
C = CO, ST = OurRegion, L = OurLocality, O = Company Name, OU = IT, CN = User Full Name,
emailAddress = user(a)real.email.address
Thanks again for your invaluable help!
Pedro.