On 16/03/18 11:33, Alexander Bokovoy wrote:
On pe, 16 maalis 2018, lejeczek via FreeIPA-users wrote:
>
>
> On 08/03/18 13:39, lejeczek via FreeIPA-users wrote:
>> hi guys
>> I'm trying to add a trust to AD, I do DNS regural(as per
>> Win Integration Guide) and all seems good, but it fails
>> with error as per the subject.
>>
>> With regards to DNS, only thing on the odd side (guide
>> mentions this record) is missing
>>
_kerberos._udp.dc._msdcs.ad.example.com
>> Would this be a problem.
>>
>> I also use --server to trust-add but it fails the same.
>>
>> How to troubleshoot it? ipa -v also does not reveal more.
>> Process asks:
>>
>> Active Directory domain administrator's password:
>>
>> and the fails immediately.
>> many thanks, L.
> anybody, guys?
>
> it's strange for I reboot win server and once it
> complains about "..RPC connection to the Active Directory
> Domain controller ipa1.." after the reboot it would
> complain about ".. ipa2....".
> And certainly both ipa hosts are dns resolvable and up &
> running and seem okey.
We aren't implementing full AD functionality in FreeIPA.
Thus, certain
flows aren't accessible from AD side. This is why we do
not run trust
validation from AD DC side but rather trigger it via RPC
calls from IPA
side when trust is established. This, however, only
possible when you
are using admin credentials, not shared secret.
So what you see is expected.
yes, but this was just to see what AD's end does/sess.
As per the subject, and as I said earlier, original problem is:
$ ipa trust-add --all eb.private.dom --admin=Administrator
--password
Active Directory domain administrator's password:
ipa: ERROR: Cannot find specified domain or server name
$ ipa -vv trust-add --all --two-way=1 --type=ad
eb.private.dom --admin=Administrator --password
--server=work7.eb.private.dom
..
ipa: ERROR: Cannot find specified domain or server name
$ realm discover eb.private.dom
eb.private.dom
type: kerberos
realm-name: EB.PRIVATE.DOM
domain-name: eb.private.dom
configured: no
server-software: active-directory
client-software: sssd
required-package: oddjob
required-package: oddjob-mkhomedir
required-package: sssd
required-package: adcli
required-package: samba-common-tools
I had trust working, initially with password, then I did
trust-del and I manually created shared-key trust on AD,
which also worked okey.
I kept fiddling with del/add and soon, after a few such
moves I hit this problem.
I feel like this might be reproducible (all boxes are
qemu-kvm), feels like after just a few(successful) del/add
something brakes.
I increased logs verbosity as per sbose's advice but cannot
find in those logs anything.
m. thanks, L.