On 16/03/18 13:12, Alexander Bokovoy wrote:
On pe, 16 maalis 2018, lejeczek wrote:
>
>
> On 16/03/18 11:33, Alexander Bokovoy wrote:
>> On pe, 16 maalis 2018, lejeczek via FreeIPA-users wrote:
>>>
>>>
>>> On 08/03/18 13:39, lejeczek via FreeIPA-users wrote:
>>>> hi guys
>>>> I'm trying to add a trust to AD, I do DNS regural(as
>>>> per Win Integration Guide) and all seems good, but it
>>>> fails with error as per the subject.
>>>>
>>>> With regards to DNS, only thing on the odd side (guide
>>>> mentions this record) is missing
>>>>
_kerberos._udp.dc._msdcs.ad.example.com
>>>> Would this be a problem.
>>>>
>>>> I also use --server to trust-add but it fails the same.
>>>>
>>>> How to troubleshoot it? ipa -v also does not reveal more.
>>>> Process asks:
>>>>
>>>> Active Directory domain administrator's password:
>>>>
>>>> and the fails immediately.
>>>> many thanks, L.
>>> anybody, guys?
>>>
>>> it's strange for I reboot win server and once it
>>> complains about "..RPC connection to the Active
>>> Directory Domain controller ipa1.." after the reboot it
>>> would complain about ".. ipa2....".
>>> And certainly both ipa hosts are dns resolvable and up
>>> & running and seem okey.
>> We aren't implementing full AD functionality in FreeIPA.
>> Thus, certain
>> flows aren't accessible from AD side. This is why we do
>> not run trust
>> validation from AD DC side but rather trigger it via RPC
>> calls from IPA
>> side when trust is established. This, however, only
>> possible when you
>> are using admin credentials, not shared secret.
>>
>> So what you see is expected.
>
> yes, but this was just to see what AD's end does/sess.
> As per the subject, and as I said earlier, original
> problem is:
>
> $ ipa trust-add --all eb.private.dom
> --admin=Administrator --password
> Active Directory domain administrator's password:
> ipa: ERROR: Cannot find specified domain or server name
>
> $ ipa -vv trust-add --all --two-way=1 --type=ad
> eb.private.dom --admin=Administrator --password
> --server=work7.eb.private.dom
> ..
> ipa: ERROR: Cannot find specified domain or server name
This is IPA not being able to find the AD server/domain.
You need to add 'log level = 50' to
/usr/share/ipa/smb.conf.empty and
re-run 'ipa trust-add'. The logs will be part of
/var/log/httpd/error_log.
I used = 100 as per sbose's advice, and the the part of the
error_log I attached a few messages earlier(under this
thread). Can you see it?
> I had trust working, initially with password, then I did
> trust-del and I manually created shared-key trust on AD,
> which also worked okey.
> I kept fiddling with del/add and soon, after a few such
> moves I hit this problem.
> I feel like this might be reproducible (all boxes are
> qemu-kvm), feels like after just a few(successful)
> del/add something brakes.
> I increased logs verbosity as per sbose's advice but
> cannot find in those logs anything.
? If you enabled 'log level = 50' in
/usr/share/ipa/smb.conf.empty,
you'll see plenty of logs in error_log.