Regards
Henrik

On 3 Dec 2017, at 21:14, Jakub Hrozek <jhrozek@redhat.com> wrote:


On 1 Dec 2017, at 10:52, Henrik Johansson <henrikj@henkis.net> wrote:

Hi,

Answers below, I found one thing that don’t look correct, on another virtualised test-system I can get a cifs ticket when I am admin on the IPA server, in this setup it only works if I get tickets from the AD domain manually first:

[root@ipaserver httpd]# kinit admin
Password for admin@IDM.TEST.NET:
[root@ipaserver httpd]# klist
Ticket cache: KEYRING:persistent:0:0
Default principal: admin@IDM.TEST.NET

Valid starting       Expires              Service principal
12/01/2017 10:25:48  12/02/2017 10:25:39  krbtgt/IDM.TEST.NET@IDM.TEST.NET
[root@ipaserver httpd]# kvno -S cifs adserver.ad2.test.net
kvno: Server krbtgt/AD2.TEST.NET@IDM.TEST.NET not found in Kerberos database while getting credentials for cifs/adserver.ad2.test.net@AD2.TEST.NET
[root@ipaserver httpd]# kinit adminuser@ad2.test.net
Password for adminuser@ad2.test.net:
Warning: Your password will expire in 5 days on Wed 06 Dec 2017 03:20:14 PM CET
[root@ipaserver httpd]# kvno -S cifs adserver.ad2.test.net
cifs/adserver.ad2.test.net@AD2.TEST.NET: kvno = 13


On 27 Nov 2017, at 14:06, Jakub Hrozek via FreeIPA-users <freeipa-users@lists.fedorahosted.org> wrote:

On Tue, Nov 21, 2017 at 01:55:31PM +0100, Henrik Stigendal via FreeIPA-users wrote:
Hello everyone,

I’m new to this and are trying to setup a working trust against an AD forrest, I seem to have a working trust but when I try to reference external groups (or users) I get:

# ipa group-add-member ad_users_external --external "AD2\Domain Users"
[member user]:
[member group]:
Group name: ad_users_external
Description: AD users external map
Failed members:
  member user:
  member group: AD2\Domain Users: trusted domain object not found
-------------------------
Number of members added 0
-------------------------

I think the lookup goes eventually from the ipa command line framework
to SSSD, does lookup through the usual SSSD channels (getent passwd
username@domain) work?

No, that does not work at all.



I enable some logging and last in the mail is the output there from the command above, any suggestions what could cause this? Current version of IPA is 4.5.

Regards
Henrik

Tue Nov 21 13:10:42.675713 2017] [:warn] [pid 38221] [client 192.168.6.82:34714] failed to set perms (3140) on file (/var/run/ipa/ccaches/admin@IDM.TEST.NET)!, referer: https://ipaserver.idm.test.net/ipa/xml
string_to_sid: SID AD2\Domain Users is not in a valid format

btw did you try also a lookup of a name qualified with the full AD domain
name (i.e. username@ad.domain instead of ad\\username)? I wonder if just
the flatname is acting up..


I’ve tested both without luck.

I would suggest to find out why the lookups from the command line don’t work. You can check how to debug sssd here:
https://docs.pagure.org/SSSD.sssd/users/sudo_troubleshooting.html

feel free to share your logs if they are not easy to read.



lpcfg_load: refreshing parameters from /usr/share/ipa/smb.conf.empty
Processing section "[global]"
INFO: Current debug levels:
all: 11
tdb: 11
printdrivers: 11
lanman: 11
smb: 11
rpc_parse: 11
rpc_srv: 11
rpc_cli: 11
passdb: 11
sam: 11
auth: 11
winbind: 11
vfs: 11
idmap: 11
quota: 11
acls: 11
locking: 11
msdfs: 11
dmapi: 11
registry: 11
scavenger: 11
dns: 11
ldb: 11
tevent: 11
pm_process() returned Yes
added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255 netmask=255.255.255.0
added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255 netmask=255.255.255.0
added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255 netmask=255.255.255.0
added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255 netmask=255.255.255.0
added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255 netmask=255.255.255.0
added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255 netmask=255.255.255.0
added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255 netmask=255.255.255.0
added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255 netmask=255.255.255.0
finddcs: searching for a DC by DNS domain ad2.test.net
finddcs: looking for SRV records for _ldap._tcp.ad2.test.net
resolve_lmhosts: Attempting lmhosts lookup for name _ldap._tcp.ad2.test.net<0x0>
getlmhostsent: lmhost entry: 127.0.0.1 localhost
ads_dns_lookup_srv: 2 records returned in the answer section.
ads_dns_parse_rr_srv: Parsed adserver.ad2.test.net [0, 100, 389]
ads_dns_parse_rr_srv: Parsed adserver.ad2.test.net [0, 100, 389]
Addrs = 192.168.5.158@389/adserver,192.168.5.104@389/adserver
finddcs: DNS SRV response 0 at '192.168.5.158'
finddcs: DNS SRV response 1 at '192.168.5.104'
finddcs: performing CLDAP query on 192.168.5.158
   &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX
      command                  : LOGON_SAM_LOGON_RESPONSE_EX (23)
      sbz                      : 0x0000 (0)
      server_type              : 0x0001f1fc (127484)
             0: NBT_SERVER_PDC
             1: NBT_SERVER_GC
             1: NBT_SERVER_LDAP
             1: NBT_SERVER_DS
             1: NBT_SERVER_KDC
             1: NBT_SERVER_TIMESERV
             1: NBT_SERVER_CLOSEST
             1: NBT_SERVER_WRITABLE
             0: NBT_SERVER_GOOD_TIMESERV
             0: NBT_SERVER_NDNC
             0: NBT_SERVER_SELECT_SECRET_DOMAIN_6
             1: NBT_SERVER_FULL_SECRET_DOMAIN_6
             1: NBT_SERVER_ADS_WEB_SERVICE
             1: NBT_SERVER_DS_8
             0: NBT_SERVER_HAS_DNS_NAME
             0: NBT_SERVER_IS_DEFAULT_NC
             0: NBT_SERVER_FOREST_ROOT
      domain_uuid              : 63c3a477-85f9-5f01-96e8-2597a5c48978
      forest                   : 'ad2.test.net'
      dns_domain               : 'ad2.test.net'
      pdc_dns_name             : 'adserver.ad2.test.net'
      domain_name              : 'AD2'
      pdc_name                 : 'adserver'
      user_name                : ''
      server_site              : 'AS001'
      client_site              : 'AS002'
      sockaddr_size            : 0x00 (0)
      sockaddr: struct nbt_sockaddr
          sockaddr_family          : 0x00000000 (0)
          pdc_ip                   : (null)
          remaining                : DATA_BLOB length=0
      next_closest_site        : NULL
      nt_version               : 0x00000005 (5)
             1: NETLOGON_NT_VERSION_1
             0: NETLOGON_NT_VERSION_5
             1: NETLOGON_NT_VERSION_5EX
             0: NETLOGON_NT_VERSION_5EX_WITH_IP
             0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE
             0: NETLOGON_NT_VERSION_AVOID_NT4EMUL
             0: NETLOGON_NT_VERSION_PDC
             0: NETLOGON_NT_VERSION_IP
             0: NETLOGON_NT_VERSION_LOCAL
             0: NETLOGON_NT_VERSION_GC
      lmnt_token               : 0xffff (65535)
      lm20_token               : 0xffff (65535)
finddcs: Found matching DC 192.168.5.158 with server_type=0x0001f1fc
[Tue Nov 21 13:10:42.740320 2017] [:error] [pid 26496] ipa: INFO: [jsonserver_session] admin@IDM.TEST.NET: group_add_member/1(u'ad_users_external', ipaexternalmember=(u'AD2\\\\Domain Users',), version=u'2.228'): SUCCESS

_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org