Looks like I got the rootDSE, 109 lines of information and got the
following at the end. I don't know much about ldap so I'm guessing this
was successful. And, yes I did get a ldap/ad.cd ticket. What should I
look at next?
Thanks,
Steve
isSynchronized: TRUE
isGlobalCatalogReady: TRUE
domainFunctionality: 6
forestFunctionality: 6
domainControllerFunctionality: 6
# search result
search: 4
result: 0 Success
# numResponses: 2
# numEntries: 1
On Thu, Jul 20, 2017 at 3:21 PM, Jakub Hrozek <jhrozek(a)redhat.com> wrote:
On Thu, Jul 20, 2017 at 12:20:31PM -0400, Steve Weeks via
FreeIPA-users
wrote:
> We've setup a two-way trust with AD and it seems to have worked, but it
> doesn't look like it is working correctly.
>
> The kerberos commands (kinit and kvno) work fine, but things like 'id
> aduser(a)addomain.example.com' and 'getent passwd
aduser(a)addomain.example.com'
> don't work.
>
> # ipa trust-add --type ad
addomain.example.com --admin adadmin
--password
> --two-way=true
> Active Directory domain administrator's password:
> -----------------------------------------------------
> Added Active Directory trust for realm "addomain.example.com"
> -----------------------------------------------------
> Realm name:
addomain.example.com
> Domain NetBIOS name: ADDOMAIN
> Domain Security Identifier: S-1-5-21-2229161606-873856335-779138662
> Trust direction: Two-way trust
> Trust type: Active Directory domain
> Trust status: Established and verified
>
> # kinit aduser(a)addomain.example.com
> Password for aduser(a)addomain.example.com:
>
> # klist
> Ticket cache: KEYRING:persistent:0:krb_ccache_o3D2R5S
> Default principal: aduser(a)ADDOMAIN.EXAMPLE.COM
>
> Valid starting Expires Service principal
> 07/20/2017 12:16:41 07/20/2017 22:16:41 krbtgt/
> ADDOMAIN.EXAMPLE.COM(a)ADDOMAIN.EXAMPLE.COM
> renew until 07/21/2017 12:16:38
>
> # id aduser(a)addomain.example.com
> id: ‘aduser(a)addomain.example.xn--com-to0a: no such user
>
> Is this the best way to test the trust?
>
> We are running FreeIPA 4.4 and Windows Server 2012 R2
>
> When setting up the trust we needed to modify /etc/hosts as described in
>
https://bugzilla.redhat.com/show_bug.cgi?id=878168
Since the trust is two-way, can you kinit using the system keytab and
try searching the AD DC? e.g.
kinit -k
ldapsearch -Y GSSAPI -H ldap://your.ad.dc -s base -b ""
that should return the rootDSE and give you the ldap/your.ad.dc ticket
in the process if the trust works OK..