Hi,
LDAP search on the node in question results in the following.
ldapsearch -Y GSSAPI -b
cn=ADTRUST,cn=`hostname`,cn=masters,cn=ipa,cn=etc,dc=my,dc=domain
SASL/GSSAPI authentication started
SASL username: admin(a)IPA.my.domain
SASL SSF: 256
SASL data security layer installed.
# extended LDIF
#
# LDAPv3
# base <cn=ADTRUST,cn=ipa2.my.domain,cn=masters,cn=ipa,cn=etc,dc=my,dc=domain> with
scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# ADTRUST, ipa2.my.domain, masters, ipa, etc, my.domain
dn: cn=ADTRUST,cn=ipa2.my.domain,cn=masters,cn=ipa,cn=etc,dc=my,dc=domain
objectClass: nsContainer
objectClass: ipaConfigObject
objectClass: top
cn: ADTRUST
ipaConfigString: startOrder 60
ipaConfigString: hiddenService
# search result
search: 4
result: 0 Success
# numResponses: 2
# numEntries: 1
If this isn’t a false positive, what steps should I take to try to resolve this?
Regards,
Duncan
--
Duncan Mortimer
On 28/06/2021, 07:27, "Alexander Bokovoy" <abokovoy(a)redhat.com> wrote:
On to, 24 kesä 2021, Rob Crittenden wrote:
> But there is no change in ipahealthcheck output.
This particular check is only run on trust controllers, those machines
with the server role of AD trust controller. (ipa server-role-show
<hostname> 'AD trust controller')
It makes sure that the ADTRUST service is marked as enabled, so that the
services will be started by ipactl (smb).
You can see it with:
kinit admin
ldapsearch -Y GSSAPI -b
cn=ADTRUST,cn=`hostname`,cn=masters,cn=ipa,cn=etc,dc=example,dc=test
So since it's a trust server and doesn't have ADTRUST enabled it means
that ipactl won't manage smb.
Now given your use case it's possible this is a false positive.
Alexander, what do you think?
ADTRUST service should be present and active if ipa-adtrust-install was
run. If it doesn't that's an error and ipa-healthcheck highlights it
correctly.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland