<div dir="ltr"><div>Hi,</div><div><br></div><div><br></div><div>I have done IPA AD trust between IPA and AD server. But trust is showing offline always. But we are able to get the AD user information. And able to grant the KRB ticket.</div><div><br></div><div><br></div><div><br></div><div># wbinfo --online-status</div><div>BUILTIN : online</div><div>IPA : online</div><div><b>CORP : offline</b></div><div><br></div><div><br></div><div>#id <a href="mailto:aduser@CORP.ADDOMAIN.COM">aduser@CORP.ADDOMAIN.COM</a></div><div>uid=1007656917(<a href="mailto:aduser@corp.addomain.com">aduser@corp.addomain.com</a>) gid=1007656917(<a href="mailto:aduser@corp.addomain.com">aduser@corp.addomain.com</a>) groups=1007656917(<a href="mailto:aduser@corp.addomain.com">aduser@corp.addomain.com</a>),1007715891(prg-msoffice2013pro(kms)@<a href="http://corp.addomain.com">corp.addomain.com</a>),1007663829(<a href="mailto:da-eeg-intra-read@corp.addomain.com">da-eeg-intra-read@corp.addomain.com</a>),1007600513(domain <a href="mailto:users@corp.addomain.com">users@corp.addomain.com</a>)</div><div><br></div><div><br></div><div>[root@ilt-gif-ipa01 ~]# kinit <a href="mailto:aduser@CORP.ADDOMAIN.COM">aduser@CORP.ADDOMAIN.COM</a></div><div>Password for <a href="mailto:aduser@CORP.ADDOMAIN.COM">aduser@CORP.ADDOMAIN.COM</a>:</div><div>[root@ilt-gif-ipa01 ~]#</div><div>[root@ilt-gif-ipa01 ~]#</div><div>[root@ilt-gif-ipa01 ~]# klist</div><div>Ticket cache: KEYRING:persistent:0:0</div><div>Default principal: <a href="mailto:aduser@CORP.ADDOMAIN.COM">aduser@CORP.ADDOMAIN.COM</a></div><div><br></div><div>Valid starting Expires Service principal</div><div>08/11/2016 13:11:35 08/11/2016 23:11:35 krbtgt/<a href="mailto:CORP.ADDOMAIN.COM@CORP.ADDOMAIN.COM">CORP.ADDOMAIN.COM@CORP.ADDOMAIN.COM</a></div><div> renew until 08/12/2016 13:11:29</div><div>[root@ilt-gif-ipa01 ~]#</div><div><br></div><div><br></div><div><br></div><div>Form IPA client server we are able to get the all thinks ( KRB ticket/ user/groups )</div><div><br></div><div>[root@ilt-gif-ipa02 ~]# getent passwd <a href="mailto:aduser@CORP.addomain.COM">aduser@CORP.addomain.COM</a></div><div>aduser@corp.addomain.com:*:1007656917:1007656917:USER NAME:/home/<a href="http://corp.addomain.com/aduser">corp.addomain.com/aduser</a>:</div><div>[root@ilt-gif-ipa02 ~]#</div><div><br></div><div><br></div><div>[root@ilt-gif-ipa02 ~]# getent group <a href="mailto:aduser@CORP.addomain.COM">aduser@CORP.addomain.COM</a></div><div>aduser@corp.addomain.com:*:1007656917:</div><div>[root@ilt-gif-ipa02 ~]#</div><div><br></div><div><br></div><div>[root@ilt-gif-ipa02 ~]# id <a href="mailto:aduser@CORP.addomain.COM">aduser@CORP.addomain.COM</a></div><div>uid=1007656917(<a href="mailto:aduser@corp.addomain.com">aduser@corp.addomain.com</a>) gid=1007656917(<a href="mailto:aduser@corp.addomain.com">aduser@corp.addomain.com</a>) groups=1007656917(<a href="mailto:aduser@corp.addomain.com">aduser@corp.addomain.com</a>),1007715891(prg-msoffice2013pro(kms)@<a href="http://corp.addomain.com">corp.addomain.com</a>),1007663829(<a href="mailto:da-eeg-intra-read@corp.addomain.com">da-eeg-intra-read@corp.addomain.com</a>),1007600513(domain <a href="mailto:users@corp.addomain.com">users@corp.addomain.com</a>),1007725088(<a href="mailto:tfs_users@corp.addomain.com">tfs_users@corp.addomain.com</a>)</div><div><br></div><div><br></div><div>Also we are to ssh to IPA client on same machine or from some other machine with gss authentication. But using password authentication it’s failed to login.</div><div><br></div><div><b>ERROR:- pam_sss(sshd:auth): authentication failure; logname</b></div><div><br></div><div><br></div><div>kinit <a href="mailto:aduser@CORP.ADDOMAIN.COM">aduser@CORP.ADDOMAIN.COM</a></div><div>Password for <a href="mailto:aduser@CORP.ADDOMAIN.COM">aduser@CORP.ADDOMAIN.COM</a>:</div><div><br></div><div><br></div><div><br></div><div>[root@ilt-gif-ipa02 ~]# ssh -vl <a href="mailto:aduser@corp.addomain.com">aduser@corp.addomain.com</a> ilt-gif-ipa02.ipa.preprod.local</div><div>OpenSSH_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013</div><div>debug1: Reading configuration data /etc/ssh/ssh_config</div><div>debug1: /etc/ssh/ssh_config line 60: Applying options for *</div><div>debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy -p 22 ilt-gif-ipa02.ipa.preprod.local</div><div>debug1: permanently_set_uid: 0/0</div><div>debug1: permanently_drop_suid: 0</div><div>debug1: identity file /root/.ssh/id_rsa type -1</div><div>debug1: identity file /root/.ssh/id_rsa-cert type -1</div><div>debug1: identity file /root/.ssh/id_dsa type -1</div><div>debug1: identity file /root/.ssh/id_dsa-cert type -1</div><div>debug1: identity file /root/.ssh/id_ecdsa type -1</div><div>debug1: identity file /root/.ssh/id_ecdsa-cert type -1</div><div>debug1: identity file /root/.ssh/id_ed25519 type -1</div><div>debug1: identity file /root/.ssh/id_ed25519-cert type -1</div><div>debug1: Enabling compatibility mode for protocol 2.0</div><div>debug1: Local version string SSH-2.0-OpenSSH_6.6.1</div><div>debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1</div><div>debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000</div><div>debug1: SSH2_MSG_KEXINIT sent</div><div>debug1: SSH2_MSG_KEXINIT received</div><div>debug1: kex: server->client aes128-ctr <a href="mailto:hmac-md5-etm@openssh.com">hmac-md5-etm@openssh.com</a> none</div><div>debug1: kex: client->server aes128-ctr <a href="mailto:hmac-md5-etm@openssh.com">hmac-md5-etm@openssh.com</a> none</div><div>debug1: kex: <a href="mailto:curve25519-sha256@libssh.org">curve25519-sha256@libssh.org</a> need=16 dh_need=16</div><div>debug1: kex: <a href="mailto:curve25519-sha256@libssh.org">curve25519-sha256@libssh.org</a> need=16 dh_need=16</div><div>debug1: sending SSH2_MSG_KEX_ECDH_INIT</div><div>debug1: expecting SSH2_MSG_KEX_ECDH_REPLY</div><div>debug1: Server host key: ECDSA f0:e6:b2:66:c8:41:06:4e:83:a4:a2:c5:5a:57:24:66</div><div>debug1: Host 'ilt-gif-ipa02.ipa.preprod.local' is known and matches the ECDSA host key.</div><div>debug1: Found key in /root/.ssh/known_hosts:3</div><div>debug1: ssh_ecdsa_verify: signature correct</div><div>debug1: SSH2_MSG_NEWKEYS sent</div><div>debug1: expecting SSH2_MSG_NEWKEYS</div><div>debug1: SSH2_MSG_NEWKEYS received</div><div>debug1: SSH2_MSG_SERVICE_REQUEST sent</div><div>debug1: SSH2_MSG_SERVICE_ACCEPT received</div><div>debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password</div><div>debug1: Next authentication method: gssapi-keyex</div><div>debug1: No valid Key exchange context</div><div>debug1: Next authentication method: gssapi-with-mic</div><div><b>debug1: Authentication succeeded (gssapi-with-mic).</b></div><div>Authenticated to ilt-gif-ipa02.ipa.preprod.local (via proxy).</div><div>debug1: channel 0: new [client-session]</div><div>debug1: Requesting <a href="mailto:no-more-sessions@openssh.com">no-more-sessions@openssh.com</a></div><div>debug1: Entering interactive session.</div><div>debug1: Sending environment.</div><div>debug1: Sending env LANG = en_US.UTF-8</div><div>Last login: Thu Aug 11 13:17:05 2016 from ilt-gif-ipa02.ipa.preprod.local</div><div><br></div><div>RHN kickstart on 2014-10-16</div><div><br></div><div>-sh-4.2$ pwd</div><div>/home/<a href="http://corp.addomain.com/aduser">corp.addomain.com/aduser</a></div><div>-sh-4.2$ who am i</div><div><a href="mailto:aduser@corp.addomain.com">aduser@corp.addomain.com</a> pts/3 2016-08-11 13:19 (ilt-gif-ipa02.ipa.preprod.local)</div><div>-sh-4.2$</div><div><br></div><div><br></div><div><br></div><div><div>]# ssh aduser@corp.addomain.com@ilt-gif-ipa02.ipa.preprod.local</div><div>e600336@corp.corpcommon.com@ilt-gif-ipa02.ipa.preprod.local's password:</div><div>Permission denied, please try again.</div><div>e600336@corp.corpcommon.com@ilt-gif-ipa02.ipa.preprod.local's password:</div></div><div><br></div><div><br></div><div>Can you please help me i am not able to login with AD user password authentication.</div><div><br></div><div><br></div><div><br></div><div>/Rajat Gupta</div> </div>