On pe, 16 maalis 2018, lejeczek wrote:
On 16/03/18 13:12, Alexander Bokovoy wrote:
>On pe, 16 maalis 2018, lejeczek wrote:
>>
>>
>>On 16/03/18 11:33, Alexander Bokovoy wrote:
>>>On pe, 16 maalis 2018, lejeczek via FreeIPA-users wrote:
>>>>
>>>>
>>>>On 08/03/18 13:39, lejeczek via FreeIPA-users wrote:
>>>>>hi guys
>>>>>I'm trying to add a trust to AD, I do DNS regural(as per Win
>>>>>Integration Guide) and all seems good, but it fails with
>>>>>error as per the subject.
>>>>>
>>>>>With regards to DNS, only thing on the odd side (guide
>>>>>mentions this record) is missing
>>>>>_kerberos._udp.dc._msdcs.ad.example.com
>>>>>Would this be a problem.
>>>>>
>>>>>I also use --server to trust-add but it fails the same.
>>>>>
>>>>>How to troubleshoot it? ipa -v also does not reveal more.
>>>>>Process asks:
>>>>>
>>>>>Active Directory domain administrator's password:
>>>>>
>>>>>and the fails immediately.
>>>>>many thanks, L.
>>>>anybody, guys?
>>>>
>>>>it's strange for I reboot win server and once it complains
>>>>about "..RPC connection to the Active Directory Domain
>>>>controller ipa1.." after the reboot it would complain about
>>>>".. ipa2....".
>>>>And certainly both ipa hosts are dns resolvable and up &
>>>>running and seem okey.
>>>We aren't implementing full AD functionality in FreeIPA. Thus,
>>>certain
>>>flows aren't accessible from AD side. This is why we do not run
>>>trust
>>>validation from AD DC side but rather trigger it via RPC calls
>>>from IPA
>>>side when trust is established. This, however, only possible
>>>when you
>>>are using admin credentials, not shared secret.
>>>
>>>So what you see is expected.
>>
>>yes, but this was just to see what AD's end does/sess.
>>As per the subject, and as I said earlier, original problem is:
>>
>>$ ipa trust-add --all eb.private.dom --admin=Administrator
>>--password
>>Active Directory domain administrator's password:
>>ipa: ERROR: Cannot find specified domain or server name
>>
>>$ ipa -vv trust-add --all --two-way=1 --type=ad eb.private.dom
>>--admin=Administrator --password --server=work7.eb.private.dom
>>..
>>ipa: ERROR: Cannot find specified domain or server name
>This is IPA not being able to find the AD server/domain.
>
>You need to add 'log level = 50' to /usr/share/ipa/smb.conf.empty
>and
>re-run 'ipa trust-add'. The logs will be part of
>/var/log/httpd/error_log.
>
>
I used = 100 as per sbose's advice, and the the part of the error_log
I attached a few messages earlier(under this thread). Can you see it?
Yes, and it is
edited to the level of being unreadable. Can you share
unedited version in private, including your DNS setup?
The reason I'm asking is because you have very inconsistent DNS name
edits, they make impossible to understand what is your real DNS
arrangement.
--
/ Alexander Bokovoy