<div dir="ltr">Thanks.<div> </div><div>When i am trying to accesses user with password i am getting below message in logs.</div><div> </div><div>Aug 18 09:38:17 ilt-gif-ipa02 [sssd[krb5_child[8505]]]: Cannot find KDC for realm "<a href="http://ADDOMAON.COM">ADDOMAON.COM</a>"</div><div> </div><div>when i connect through ssh, it tries to contact the KDC for the realm <a href="http://ADDOMAON.COM">ADDOMAON.COM</a> which should be <a href="http://corp.addomain.com">corp.addomain.com</a> Do you have any further comments or suggestions that may help us. /Rajat</div><div> <div> </div></div></div><div class="gmail_extra"> <div class="gmail_quote">On Tue, Aug 16, 2016 at 2:46 PM, Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Tue, 16 Aug 2016, rajat gupta wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Hi, I have done IPA AD trust between IPA and AD server. But trust is showing offline always. But we are able to get the AD user information. And able to grant the KRB ticket. # wbinfo --online-status BUILTIN : online IPA : online *CORP : offline* </blockquote> Don't use wbinfo. Its output is irrelevant starting from FreeIPA 3.3. <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> #id <a href="mailto:aduser@CORP.ADDOMAIN.COM" target="_blank">aduser@CORP.ADDOMAIN.COM</a> uid=1007656917(<a href="mailto:aduser@corp.addomain.com" target="_blank">aduser@corp.addomain.com</a>) gid=1007656917( <a href="mailto:aduser@corp.addomain.com" target="_blank">aduser@corp.addomain.com</a>) groups=1007656917(<a href="mailto:aduser@corp.addomain.com" target="_blank">aduser@corp.addomain.com</a> ),1007715891(prg-msoffice2013pro(kms)@<a href="http://corp.addomain.com" rel="noreferrer" target="_blank">corp.addomain.com</a>),1007663829( <a href="mailto:da-eeg-intra-read@corp.addomain.com" target="_blank">da-eeg-intra-read@corp.addomain.com</a>),1007600513(domain <a href="mailto:users@corp.addomain.com" target="_blank">users@corp.addomain.com</a>) [root@ilt-gif-ipa01 ~]# kinit <a href="mailto:aduser@CORP.ADDOMAIN.COM" target="_blank">aduser@CORP.ADDOMAIN.COM</a> Password for <a href="mailto:aduser@CORP.ADDOMAIN.COM" target="_blank">aduser@CORP.ADDOMAIN.COM</a>: [root@ilt-gif-ipa01 ~]# [root@ilt-gif-ipa01 ~]# [root@ilt-gif-ipa01 ~]# klist Ticket cache: KEYRING:persistent:0:0 Default principal: <a href="mailto:aduser@CORP.ADDOMAIN.COM" target="_blank">aduser@CORP.ADDOMAIN.COM</a> Valid starting Expires Service principal 08/11/2016 13:11:35 08/11/2016 23:11:35 krbtgt/ <a href="mailto:CORP.ADDOMAIN.COM@CORP.ADDOMAIN.COM" target="_blank">CORP.ADDOMAIN.COM@CORP.ADDOMAIN.COM</a> renew until 08/12/2016 13:11:29 [root@ilt-gif-ipa01 ~]# </blockquote> This is irrelevant for the trust case because you are authenticating against AD DCs, not IPA KDCs. <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Form IPA client server we are able to get the all thinks ( KRB ticket/ user/groups ) [root@ilt-gif-ipa02 ~]# getent passwd <a href="mailto:aduser@CORP.addomain.COM" target="_blank">aduser@CORP.addomain.COM</a> aduser@corp.addomain.com:*:1007656917:1007656917:USER NAME:/home/ <a href="http://corp.addomain.com/aduser" rel="noreferrer" target="_blank">corp.addomain.com/aduser</a>: [root@ilt-gif-ipa02 ~]# [root@ilt-gif-ipa02 ~]# getent group <a href="mailto:aduser@CORP.addomain.COM" target="_blank">aduser@CORP.addomain.COM</a> aduser@corp.addomain.com:*:1007656917: [root@ilt-gif-ipa02 ~]# [root@ilt-gif-ipa02 ~]# id <a href="mailto:aduser@CORP.addomain.COM" target="_blank">aduser@CORP.addomain.COM</a> uid=1007656917(<a href="mailto:aduser@corp.addomain.com" target="_blank">aduser@corp.addomain.com</a>) gid=1007656917( <a href="mailto:aduser@corp.addomain.com" target="_blank">aduser@corp.addomain.com</a>) groups=1007656917(<a href="mailto:aduser@corp.addomain.com" target="_blank">aduser@corp.addomain.com</a> ),1007715891(prg-msoffice2013pro(kms)@<a href="http://corp.addomain.com" rel="noreferrer" target="_blank">corp.addomain.com</a>),1007663829( <a href="mailto:da-eeg-intra-read@corp.addomain.com" target="_blank">da-eeg-intra-read@corp.addomain.com</a>),1007600513(domain <a href="mailto:users@corp.addomain.com" target="_blank">users@corp.addomain.com</a>),1007725088(<a href="mailto:tfs_users@corp.addomain.com" target="_blank">tfs_users@corp.addomain.com</a>) Also we are to ssh to IPA client on same machine or from some other machine with gss authentication. But using password authentication it’s failed to login. *ERROR:- pam_sss(sshd:auth): authentication failure; logname*<div><div class="h5"> kinit <a href="mailto:aduser@CORP.ADDOMAIN.COM" target="_blank">aduser@CORP.ADDOMAIN.COM</a> Password for <a href="mailto:aduser@CORP.ADDOMAIN.COM" target="_blank">aduser@CORP.ADDOMAIN.COM</a>: [root@ilt-gif-ipa02 ~]# ssh -vl <a href="mailto:aduser@corp.addomain.com" target="_blank">aduser@corp.addomain.com</a> ilt-gif-ipa02.ipa.preprod.local OpenSSH_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 60: Applying options for * debug1: Executing proxy command: exec /usr/bin/sss_ssh_knownhostsproxy -p 22 ilt-gif-ipa02.ipa.preprod.local debug1: permanently_set_uid: 0/0 debug1: permanently_drop_suid: 0 debug1: identity file /root/.ssh/id_rsa type -1 debug1: identity file /root/.ssh/id_rsa-cert type -1 debug1: identity file /root/.ssh/id_dsa type -1 debug1: identity file /root/.ssh/id_dsa-cert type -1 debug1: identity file /root/.ssh/id_ecdsa type -1 debug1: identity file /root/.ssh/id_ecdsa-cert type -1 debug1: identity file /root/.ssh/id_ed25519 type -1 debug1: identity file /root/.ssh/id_ed25519-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH_6.6.1 debug1: Remote protocol version 2.0, remote software version OpenSSH_6.6.1 debug1: match: OpenSSH_6.6.1 pat OpenSSH_6.6.1* compat 0x04000000 debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: server->client aes128-ctr <a href="mailto:hmac-md5-etm@openssh.com" target="_blank">hmac-md5-etm@openssh.com</a> none debug1: kex: client->server aes128-ctr <a href="mailto:hmac-md5-etm@openssh.com" target="_blank">hmac-md5-etm@openssh.com</a> none debug1: kex: <a href="mailto:curve25519-sha256@libssh.org" target="_blank">curve25519-sha256@libssh.org</a> need=16 dh_need=16 debug1: kex: <a href="mailto:curve25519-sha256@libssh.org" target="_blank">curve25519-sha256@libssh.org</a> need=16 dh_need=16 debug1: sending SSH2_MSG_KEX_ECDH_INIT debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: Server host key: ECDSA f0:e6:b2:66:c8:41:06:4e:83:a4:a2:c5:5a:57:24:66 debug1: Host 'ilt-gif-ipa02.ipa.preprod.local' is known and matches the ECDSA host key. debug1: Found key in /root/.ssh/known_hosts:3 debug1: ssh_ecdsa_verify: signature correct debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password debug1: Next authentication method: gssapi-keyex debug1: No valid Key exchange context debug1: Next authentication method: gssapi-with-mic </div></div> *debug1: Authentication succeeded (gssapi-with-mic).* Authenticated to ilt-gif-ipa02.ipa.preprod.local (via proxy). debug1: channel 0: new [client-session] debug1: Requesting <a href="mailto:no-more-sessions@openssh.com" target="_blank">no-more-sessions@openssh.com</a> debug1: Entering interactive session. debug1: Sending environment. debug1: Sending env LANG = en_US.UTF-8 Last login: Thu Aug 11 13:17:05 2016 from ilt-gif-ipa02.ipa.preprod.local RHN kickstart on 2014-10-16 -sh-4.2$ pwd /home/<a href="http://corp.addomain.com/aduser" rel="noreferrer" target="_blank">corp.addomain.com/aduser</a> -sh-4.2$ who am i <a href="mailto:aduser@corp.addomain.com" target="_blank">aduser@corp.addomain.com</a> pts/3 2016-08-11 13:19 (ilt-gif-ipa02.ipa.preprod.local) -sh-4.2$ ]# ssh aduser@corp.addomain.com@ilt-gif-ipa02.ipa.preprod.local e600336@corp.corpcommon.com@ilt-gif-ipa02.ipa.preprod.local's password: Permission denied, please try again. e600336@corp.corpcommon.com@ilt-gif-ipa02.ipa.preprod.local's password: Can you please help me i am not able to login with AD user password authentication. </blockquote> If you cannot login with password but can with Kerberos credentials, you need to look into SSSD logs on the ilt-gif-ipa02.ipa.preprod.local host. See <a href="https://fedorahosted.org/sssd/wiki/Troubleshooting" rel="noreferrer" target="_blank">https://fedorahosted.org/sssd/wiki/Troubleshooting</a> -- / Alexander Bokovoy </blockquote></div> <div> </div>-- <div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">Rajat Gupta <img style="margin:0pt 0.2ex;vertical-align:middle" src="http://../1/e/330"></div></div> </div>