On 1 Dec 2017, at 10:52, Henrik Johansson <henrikj(a)henkis.net>
wrote:
Hi,
Answers below, I found one thing that don’t look correct, on another virtualised
test-system I can get a cifs ticket when I am admin on the IPA server, in this setup it
only works if I get tickets from the AD domain manually first:
[root@ipaserver httpd]# kinit admin
Password for admin(a)IDM.TEST.NET:
[root@ipaserver httpd]# klist
Ticket cache: KEYRING:persistent:0:0
Default principal: admin(a)IDM.TEST.NET
Valid starting Expires Service principal
12/01/2017 10:25:48 12/02/2017 10:25:39 krbtgt/IDM.TEST.NET(a)IDM.TEST.NET
[root@ipaserver httpd]# kvno -S cifs
adserver.ad2.test.net
kvno: Server krbtgt/AD2.TEST.NET(a)IDM.TEST.NET not found in Kerberos database while
getting credentials for cifs/adserver.ad2.test.net(a)AD2.TEST.NET
[root@ipaserver httpd]# kinit adminuser(a)ad2.test.net
Password for adminuser(a)ad2.test.net:
Warning: Your password will expire in 5 days on Wed 06 Dec 2017 03:20:14 PM CET
[root@ipaserver httpd]# kvno -S cifs
adserver.ad2.test.net
cifs/adserver.ad2.test.net(a)AD2.TEST.NET: kvno = 13
> On 27 Nov 2017, at 14:06, Jakub Hrozek via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
>
> On Tue, Nov 21, 2017 at 01:55:31PM +0100, Henrik Stigendal via FreeIPA-users wrote:
>> Hello everyone,
>>
>> I’m new to this and are trying to setup a working trust against an AD forrest, I
seem to have a working trust but when I try to reference external groups (or users) I
get:
>>
>> # ipa group-add-member ad_users_external --external "AD2\Domain Users"
>> [member user]:
>> [member group]:
>> Group name: ad_users_external
>> Description: AD users external map
>> Failed members:
>> member user:
>> member group: AD2\Domain Users: trusted domain object not found
>> -------------------------
>> Number of members added 0
>> -------------------------
>
> I think the lookup goes eventually from the ipa command line framework
> to SSSD, does lookup through the usual SSSD channels (getent passwd
> username@domain) work?
No, that does not work at all.
>
>>
>> I enable some logging and last in the mail is the output there from the command
above, any suggestions what could cause this? Current version of IPA is 4.5.
>>
>> Regards
>> Henrik
>>
>> Tue Nov 21 13:10:42.675713 2017] [:warn] [pid 38221] [client 192.168.6.82:34714]
failed to set perms (3140) on file (/var/run/ipa/ccaches/admin(a)IDM.TEST.NET)!, referer:
https://ipaserver.idm.test.net/ipa/xml
>> string_to_sid: SID AD2\Domain Users is not in a valid format
>
> btw did you try also a lookup of a name qualified with the full AD domain
> name (i.e. username(a)ad.domain instead of ad\\username)? I wonder if just
> the flatname is acting up..
I’ve tested both without luck.
I would suggest to find out why the lookups from the command line don’t work. You can
check how to debug sssd here:
https://docs.pagure.org/SSSD.sssd/users/sudo_troubleshooting.html
feel free to share your logs if they are not easy to read.
>
>> lpcfg_load: refreshing parameters from /usr/share/ipa/smb.conf.empty
>> Processing section "[global]"
>> INFO: Current debug levels:
>> all: 11
>> tdb: 11
>> printdrivers: 11
>> lanman: 11
>> smb: 11
>> rpc_parse: 11
>> rpc_srv: 11
>> rpc_cli: 11
>> passdb: 11
>> sam: 11
>> auth: 11
>> winbind: 11
>> vfs: 11
>> idmap: 11
>> quota: 11
>> acls: 11
>> locking: 11
>> msdfs: 11
>> dmapi: 11
>> registry: 11
>> scavenger: 11
>> dns: 11
>> ldb: 11
>> tevent: 11
>> pm_process() returned Yes
>> added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255
netmask=255.255.255.0
>> added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255
netmask=255.255.255.0
>> added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255
netmask=255.255.255.0
>> added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255
netmask=255.255.255.0
>> added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255
netmask=255.255.255.0
>> added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255
netmask=255.255.255.0
>> added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255
netmask=255.255.255.0
>> added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255
netmask=255.255.255.0
>> finddcs: searching for a DC by DNS domain
ad2.test.net
>> finddcs: looking for SRV records for
_ldap._tcp.ad2.test.net
>> resolve_lmhosts: Attempting lmhosts lookup for name
_ldap._tcp.ad2.test.net<0x0>
>> getlmhostsent: lmhost entry: 127.0.0.1 localhost
>> ads_dns_lookup_srv: 2 records returned in the answer section.
>> ads_dns_parse_rr_srv: Parsed
adserver.ad2.test.net [0, 100, 389]
>> ads_dns_parse_rr_srv: Parsed
adserver.ad2.test.net [0, 100, 389]
>> Addrs = 192.168.5.158@389/adserver,192.168.5.104(a)389/adserver
>> finddcs: DNS SRV response 0 at '192.168.5.158'
>> finddcs: DNS SRV response 1 at '192.168.5.104'
>> finddcs: performing CLDAP query on 192.168.5.158
>> &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX
>> command : LOGON_SAM_LOGON_RESPONSE_EX (23)
>> sbz : 0x0000 (0)
>> server_type : 0x0001f1fc (127484)
>> 0: NBT_SERVER_PDC
>> 1: NBT_SERVER_GC
>> 1: NBT_SERVER_LDAP
>> 1: NBT_SERVER_DS
>> 1: NBT_SERVER_KDC
>> 1: NBT_SERVER_TIMESERV
>> 1: NBT_SERVER_CLOSEST
>> 1: NBT_SERVER_WRITABLE
>> 0: NBT_SERVER_GOOD_TIMESERV
>> 0: NBT_SERVER_NDNC
>> 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6
>> 1: NBT_SERVER_FULL_SECRET_DOMAIN_6
>> 1: NBT_SERVER_ADS_WEB_SERVICE
>> 1: NBT_SERVER_DS_8
>> 0: NBT_SERVER_HAS_DNS_NAME
>> 0: NBT_SERVER_IS_DEFAULT_NC
>> 0: NBT_SERVER_FOREST_ROOT
>> domain_uuid : 63c3a477-85f9-5f01-96e8-2597a5c48978
>> forest : 'ad2.test.net'
>> dns_domain : 'ad2.test.net'
>> pdc_dns_name : 'adserver.ad2.test.net'
>> domain_name : 'AD2'
>> pdc_name : 'adserver'
>> user_name : ''
>> server_site : 'AS001'
>> client_site : 'AS002'
>> sockaddr_size : 0x00 (0)
>> sockaddr: struct nbt_sockaddr
>> sockaddr_family : 0x00000000 (0)
>> pdc_ip : (null)
>> remaining : DATA_BLOB length=0
>> next_closest_site : NULL
>> nt_version : 0x00000005 (5)
>> 1: NETLOGON_NT_VERSION_1
>> 0: NETLOGON_NT_VERSION_5
>> 1: NETLOGON_NT_VERSION_5EX
>> 0: NETLOGON_NT_VERSION_5EX_WITH_IP
>> 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE
>> 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL
>> 0: NETLOGON_NT_VERSION_PDC
>> 0: NETLOGON_NT_VERSION_IP
>> 0: NETLOGON_NT_VERSION_LOCAL
>> 0: NETLOGON_NT_VERSION_GC
>> lmnt_token : 0xffff (65535)
>> lm20_token : 0xffff (65535)
>> finddcs: Found matching DC 192.168.5.158 with server_type=0x0001f1fc
>> [Tue Nov 21 13:10:42.740320 2017] [:error] [pid 26496] ipa: INFO:
[jsonserver_session] admin(a)IDM.TEST.NET: group_add_member/1(u'ad_users_external',
ipaexternalmember=(u'AD2\\\\Domain Users',), version=u'2.228'): SUCCESS
>
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org