Hi All,

We are trying to get to the bottom of an issue with a (single instance) IPA server in a trust relationship with AD.  IPA will (intermittently) fail to resolve all of a users’ groups.

The IPA domain is ‘unix.domain.com’ and the AD domain is ‘domain.com’.

Having been through the logs for clues as to why this is happening, one error that stands out is this one:

(Sun Aug  2 03:20:03 2020) [sssd[be[unix.domain.com]]] [be_mark_subdom_offline] (0x1000): Marking subdomain domain.com as inactive

This error is present in the log on the IPA server many, many thousands of times.

The output of ‘sssctl domain-status domain.com’ on the IPA server also seems to see AD as being offline:

root@vmpr-linuxidm:~#
==> sssctl domain-status domain.com
Online status: Offline

Active servers:
AD Global Catalog: papr-dc1.domain.com
AD Domain Controller: papr-dc1.domain.com
IPA: vmpr-linuxidm.unix.domain.com

Discovered AD Global Catalog servers:
- vmpr-fac-dc2.facility.domain.com
- papr-dc1.domain.com
- papr-dc3.domain.com
- vmpr-fac-dc1.facility.domain.com
- papr-dc2.domain.com
- azspr-dc1.domain.com
- stpr-dc1.domain.com
- stpr-dc2.domain.com
- papr-dc4.domain.com

Discovered AD Domain Controller servers:
- papr-dc1.domain.com
- papr-dc2.domain.com
- papr-dc3.domain.com
- papr-dc4.domain.com
- azspr-dc1.domain.com
- stpr-dc2.domain.com
- stpr-dc1.domain.com

Discovered IPA servers:
- vmpr-linuxidm.unix.domain.com

I don’t know whether this error is related to the symptom we’re seeing with the groups, but it seems like an obvious problem that we should endeavour to fix as a first step.

If AD were truly ‘offline’, then I’d expect NO resolution of trust users/groups to occur at all, but that’s not the case.

Can anyone provide some pointers to help debug why IPA would think the AD domain is offline?

Regards,

Robert.