On Mon, Jul 24, 2017 at 09:05:59AM -0400, Jason Beck wrote:
On Jul 24, 2017 4:14 AM, "Jakub Hrozek via FreeIPA-users"
> On Fri, Jul 21, 2017 at 03:43:58PM -0400, Jason Beck via FreeIPA-users
> > I have been trying to reliably get an AD trust setup for a few weeks and
> > matter what I try, when I goto add AD users to an external group in
> > FreeIPA, I get:
> > "trusted domain object not found"
> > Googling around tends to always yield the same suggestions:
> > 1) Check time sync
> > 2) Check DNS
> > 3) Check firewall
> > I have done all of this ad nauseam in several different environments with
> > several different versions of FreeIPA and Windows servers. I have
> gotten a
> > setup to work maybe 2% of the time out of hundreds of attempts.
> > I am currently using FreeIPA 4.5.2 on Fedora 25 (out of the COPR repo).
> > am trying to establish trust with a mixed Windows 2012 & 2008 forest. I
> > have tried both one and two way trusts. Everything seems to work fine up
> > until I try to add AD users to FreeIPA.
> > I have verified all of the requisite DNS records exist and return the
> > proper information on both sides, there are no firewalls between any of
> > hosts, and the AD servers and FreeIPA servers are synchronized by the
> > NTP servers.
> > What could I possibly be missing?
> Can you resolve the object you're trying to add with sssd?
> e.g. id foo(a)windows.domain
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
No. I can login via Kerberos, kinit user(a)ad.domain. But neither id
user(a)ad.domain nor getent passwd user(a)ad.domain are successful.
Then please follow