We are trying to get to the bottom of an issue with a (single instance) IPA server in a trust relationship with AD. IPA will (intermittently) fail to resolve all of a users’ groups.
Having been through the logs for clues as to why this is happening, one error that stands out is this one:
(Sun Aug 2 03:20:03 2020) [sssd[be[unix.domain.com
]]] [be_mark_subdom_offline] (0x1000): Marking subdomain
This error is present in the log on the IPA server many, many thousands of times.
The output of ‘sssctl domain-status
’ on the IPA server also seems to see AD as being offline:
I don’t know whether this error is related to the symptom we’re seeing with the groups, but it seems like an obvious problem that we should endeavour to fix as a first step.
If AD were truly ‘offline’, then I’d expect NO resolution of trust users/groups to occur at all, but that’s not the case.
Can anyone provide some pointers to help debug why IPA would think the AD domain is offline?