Hi again,
I have generated debug, both in samba and in sssd and attached the log files. From what I
can see from the sssd-logfile we are talkin to the AD domain but does not find any groups?
The rest for the debug files are from the whole session including the trust-add. If you
could have a quick look at it I would be grateful since pretty much stuck here.
Terminal output:
# ipa -v trust-add --type=ad
ad.test.net --admin aduser
ipa: INFO: trying
https://ipaserver.idm.test.net/ipa/session/json
ipa: INFO: [try 1]: Forwarding 'schema' to json server
'https://ipaserver.idm.test.net/ipa/session/json'
ipa: INFO: trying
https://ipaserver.idm.test.net/ipa/session/json
Active Directory domain administrator's password:
ipa: INFO: [try 1]: Forwarding 'trust_add/1' to json server
'https://ipaserver.idm.test.net/ipa/session/json'
-----------------------------------------------------
Added Active Directory trust for realm "ad.test.net"
-----------------------------------------------------
Realm name:
ad.test.net
Domain NetBIOS name: AD
Domain Security Identifier: S-1-6-42-491525448-2008367481-725548543
Trust direction: Trusting forest
Trust type: Active Directory domain
Trust status: Established and verified
# ipa trust-fetch-domains
ad.test.net
----------------------------------------------------------------------------------------
List of trust domains successfully refreshed. Use trustdomain-find command to list them.
----------------------------------------------------------------------------------------
----------------------------
Number of entries returned 0
----------------------------
[root@ipaserver samba]# ipa trustdomain-find
ad.test.net
Domain name:
ad.test.net
Domain NetBIOS name: AD
Domain Security Identifier: S-1-6-42-491525448-2008367481-725548543
Domain enabled: True
Domain name:
corp.ad.test.net
Domain NetBIOS name: CORP
Domain Security Identifier: S-1-6-42-2417082233-1637723082-1916539915
Domain enabled: True
----------------------------
Number of entries returned 2
]# ipa -v group-add-member ad_users_external --external 'AD\Domain Users'
ipa: INFO: trying
https://ipaserver.idm.test.net/ipa/session/json
[member user]:
[member group]:
ipa: INFO: [try 1]: Forwarding 'group_add_member/1' to json server
'https://ipaserver.idm.test.net/ipa/session/json'
Group name: ad_users_external
Description: AD users external map
Failed members:
member user:
member group: AD\Domain Users: trusted domain object not found
-------------------------
Number of members added 0
Regards
Henrik
On 3 Dec 2017, at 21:14, Jakub Hrozek <jhrozek(a)redhat.com>
wrote:
> On 1 Dec 2017, at 10:52, Henrik Johansson <henrikj(a)henkis.net> wrote:
>
> Hi,
>
> Answers below, I found one thing that don’t look correct, on another virtualised
test-system I can get a cifs ticket when I am admin on the IPA server, in this setup it
only works if I get tickets from the AD domain manually first:
>
> [root@ipaserver httpd]# kinit admin
> Password for admin(a)IDM.TEST.NET:
> [root@ipaserver httpd]# klist
> Ticket cache: KEYRING:persistent:0:0
> Default principal: admin(a)IDM.TEST.NET
>
> Valid starting Expires Service principal
> 12/01/2017 10:25:48 12/02/2017 10:25:39 krbtgt/IDM.TEST.NET(a)IDM.TEST.NET
> [root@ipaserver httpd]# kvno -S cifs
adserver.ad2.test.net
> kvno: Server krbtgt/AD2.TEST.NET(a)IDM.TEST.NET not found in Kerberos database while
getting credentials for cifs/adserver.ad2.test.net(a)AD2.TEST.NET
> [root@ipaserver httpd]# kinit adminuser(a)ad2.test.net
> Password for adminuser(a)ad2.test.net:
> Warning: Your password will expire in 5 days on Wed 06 Dec 2017 03:20:14 PM CET
> [root@ipaserver httpd]# kvno -S cifs
adserver.ad2.test.net
> cifs/adserver.ad2.test.net(a)AD2.TEST.NET: kvno = 13
>
>
>> On 27 Nov 2017, at 14:06, Jakub Hrozek via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
>>
>> On Tue, Nov 21, 2017 at 01:55:31PM +0100, Henrik Stigendal via FreeIPA-users
wrote:
>>> Hello everyone,
>>>
>>> I’m new to this and are trying to setup a working trust against an AD
forrest, I seem to have a working trust but when I try to reference external groups (or
users) I get:
>>>
>>> # ipa group-add-member ad_users_external --external "AD2\Domain
Users"
>>> [member user]:
>>> [member group]:
>>> Group name: ad_users_external
>>> Description: AD users external map
>>> Failed members:
>>> member user:
>>> member group: AD2\Domain Users: trusted domain object not found
>>> -------------------------
>>> Number of members added 0
>>> -------------------------
>>
>> I think the lookup goes eventually from the ipa command line framework
>> to SSSD, does lookup through the usual SSSD channels (getent passwd
>> username@domain) work?
>
> No, that does not work at all.
>
>>
>>>
>>> I enable some logging and last in the mail is the output there from the
command above, any suggestions what could cause this? Current version of IPA is 4.5.
>>>
>>> Regards
>>> Henrik
>>>
>>> Tue Nov 21 13:10:42.675713 2017] [:warn] [pid 38221] [client
192.168.6.82:34714] failed to set perms (3140) on file
(/var/run/ipa/ccaches/admin(a)IDM.TEST.NET)!, referer:
https://ipaserver.idm.test.net/ipa/xml
>>> string_to_sid: SID AD2\Domain Users is not in a valid format
>>
>> btw did you try also a lookup of a name qualified with the full AD domain
>> name (i.e. username(a)ad.domain instead of ad\\username)? I wonder if just
>> the flatname is acting up..
>
>
> I’ve tested both without luck.
I would suggest to find out why the lookups from the command line don’t work. You can
check how to debug sssd here:
https://docs.pagure.org/SSSD.sssd/users/sudo_troubleshooting.html
feel free to share your logs if they are not easy to read.
>
>>
>>> lpcfg_load: refreshing parameters from /usr/share/ipa/smb.conf.empty
>>> Processing section "[global]"
>>> INFO: Current debug levels:
>>> all: 11
>>> tdb: 11
>>> printdrivers: 11
>>> lanman: 11
>>> smb: 11
>>> rpc_parse: 11
>>> rpc_srv: 11
>>> rpc_cli: 11
>>> passdb: 11
>>> sam: 11
>>> auth: 11
>>> winbind: 11
>>> vfs: 11
>>> idmap: 11
>>> quota: 11
>>> acls: 11
>>> locking: 11
>>> msdfs: 11
>>> dmapi: 11
>>> registry: 11
>>> scavenger: 11
>>> dns: 11
>>> ldb: 11
>>> tevent: 11
>>> pm_process() returned Yes
>>> added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255
netmask=255.255.255.0
>>> added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255
netmask=255.255.255.0
>>> added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255
netmask=255.255.255.0
>>> added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255
netmask=255.255.255.0
>>> added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255
netmask=255.255.255.0
>>> added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255
netmask=255.255.255.0
>>> added interface eno16780032 ip=192.168.6.82 bcast=192.168.6.255
netmask=255.255.255.0
>>> added interface eno33559296 ip=192.168.44.67 bcast=192.168.44.255
netmask=255.255.255.0
>>> finddcs: searching for a DC by DNS domain
ad2.test.net
>>> finddcs: looking for SRV records for
_ldap._tcp.ad2.test.net
>>> resolve_lmhosts: Attempting lmhosts lookup for name
_ldap._tcp.ad2.test.net<0x0>
>>> getlmhostsent: lmhost entry: 127.0.0.1 localhost
>>> ads_dns_lookup_srv: 2 records returned in the answer section.
>>> ads_dns_parse_rr_srv: Parsed
adserver.ad2.test.net [0, 100, 389]
>>> ads_dns_parse_rr_srv: Parsed
adserver.ad2.test.net [0, 100, 389]
>>> Addrs = 192.168.5.158@389/adserver,192.168.5.104(a)389/adserver
>>> finddcs: DNS SRV response 0 at '192.168.5.158'
>>> finddcs: DNS SRV response 1 at '192.168.5.104'
>>> finddcs: performing CLDAP query on 192.168.5.158
>>> &response->data.nt5_ex: struct NETLOGON_SAM_LOGON_RESPONSE_EX
>>> command : LOGON_SAM_LOGON_RESPONSE_EX (23)
>>> sbz : 0x0000 (0)
>>> server_type : 0x0001f1fc (127484)
>>> 0: NBT_SERVER_PDC
>>> 1: NBT_SERVER_GC
>>> 1: NBT_SERVER_LDAP
>>> 1: NBT_SERVER_DS
>>> 1: NBT_SERVER_KDC
>>> 1: NBT_SERVER_TIMESERV
>>> 1: NBT_SERVER_CLOSEST
>>> 1: NBT_SERVER_WRITABLE
>>> 0: NBT_SERVER_GOOD_TIMESERV
>>> 0: NBT_SERVER_NDNC
>>> 0: NBT_SERVER_SELECT_SECRET_DOMAIN_6
>>> 1: NBT_SERVER_FULL_SECRET_DOMAIN_6
>>> 1: NBT_SERVER_ADS_WEB_SERVICE
>>> 1: NBT_SERVER_DS_8
>>> 0: NBT_SERVER_HAS_DNS_NAME
>>> 0: NBT_SERVER_IS_DEFAULT_NC
>>> 0: NBT_SERVER_FOREST_ROOT
>>> domain_uuid : 63c3a477-85f9-5f01-96e8-2597a5c48978
>>> forest : 'ad2.test.net'
>>> dns_domain : 'ad2.test.net'
>>> pdc_dns_name : 'adserver.ad2.test.net'
>>> domain_name : 'AD2'
>>> pdc_name : 'adserver'
>>> user_name : ''
>>> server_site : 'AS001'
>>> client_site : 'AS002'
>>> sockaddr_size : 0x00 (0)
>>> sockaddr: struct nbt_sockaddr
>>> sockaddr_family : 0x00000000 (0)
>>> pdc_ip : (null)
>>> remaining : DATA_BLOB length=0
>>> next_closest_site : NULL
>>> nt_version : 0x00000005 (5)
>>> 1: NETLOGON_NT_VERSION_1
>>> 0: NETLOGON_NT_VERSION_5
>>> 1: NETLOGON_NT_VERSION_5EX
>>> 0: NETLOGON_NT_VERSION_5EX_WITH_IP
>>> 0: NETLOGON_NT_VERSION_WITH_CLOSEST_SITE
>>> 0: NETLOGON_NT_VERSION_AVOID_NT4EMUL
>>> 0: NETLOGON_NT_VERSION_PDC
>>> 0: NETLOGON_NT_VERSION_IP
>>> 0: NETLOGON_NT_VERSION_LOCAL
>>> 0: NETLOGON_NT_VERSION_GC
>>> lmnt_token : 0xffff (65535)
>>> lm20_token : 0xffff (65535)
>>> finddcs: Found matching DC 192.168.5.158 with server_type=0x0001f1fc
>>> [Tue Nov 21 13:10:42.740320 2017] [:error] [pid 26496] ipa: INFO:
[jsonserver_session] admin(a)IDM.TEST.NET: group_add_member/1(u'ad_users_external',
ipaexternalmember=(u'AD2\\\\Domain Users',), version=u'2.228'): SUCCESS
>>
>>> _______________________________________________
>>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>> _______________________________________________
>> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org