On pe, 16 maalis 2018, lejeczek wrote:
On 16/03/18 11:33, Alexander Bokovoy wrote:
>On pe, 16 maalis 2018, lejeczek via FreeIPA-users wrote:
>>
>>
>>On 08/03/18 13:39, lejeczek via FreeIPA-users wrote:
>>>hi guys
>>>I'm trying to add a trust to AD, I do DNS regural(as per Win
>>>Integration Guide) and all seems good, but it fails with error
>>>as per the subject.
>>>
>>>With regards to DNS, only thing on the odd side (guide mentions
>>>this record) is missing
_kerberos._udp.dc._msdcs.ad.example.com
>>>Would this be a problem.
>>>
>>>I also use --server to trust-add but it fails the same.
>>>
>>>How to troubleshoot it? ipa -v also does not reveal more.
>>>Process asks:
>>>
>>>Active Directory domain administrator's password:
>>>
>>>and the fails immediately.
>>>many thanks, L.
>>anybody, guys?
>>
>>it's strange for I reboot win server and once it complains about
>>"..RPC connection to the Active Directory Domain controller
>>ipa1.." after the reboot it would complain about ".. ipa2....".
>>And certainly both ipa hosts are dns resolvable and up & running
>>and seem okey.
>We aren't implementing full AD functionality in FreeIPA. Thus,
>certain
>flows aren't accessible from AD side. This is why we do not run
>trust
>validation from AD DC side but rather trigger it via RPC calls from
>IPA
>side when trust is established. This, however, only possible when
>you
>are using admin credentials, not shared secret.
>
>So what you see is expected.
yes, but this was just to see what AD's end does/sess.
As per the subject, and as I said earlier, original problem is:
$ ipa trust-add --all eb.private.dom --admin=Administrator --password
Active Directory domain administrator's password:
ipa: ERROR: Cannot find specified domain or server name
$ ipa -vv trust-add --all --two-way=1 --type=ad eb.private.dom
--admin=Administrator --password --server=work7.eb.private.dom
..
ipa: ERROR: Cannot find specified domain or server name
This is IPA not being able
to find the AD server/domain.
You need to add 'log level = 50' to /usr/share/ipa/smb.conf.empty and
re-run 'ipa trust-add'. The logs will be part of
/var/log/httpd/error_log.
I had trust working, initially with password, then I did trust-del and
I manually created shared-key trust on AD, which also worked okey.
I kept fiddling with del/add and soon, after a few such moves I hit
this problem.
I feel like this might be reproducible (all boxes are qemu-kvm), feels
like after just a few(successful) del/add something brakes.
I increased logs verbosity as per sbose's advice but cannot find in
those logs anything.
? If you enabled 'log level = 50' in
/usr/share/ipa/smb.conf.empty,
you'll see plenty of logs in error_log.
--
/ Alexander Bokovoy