<div dir="ltr">Hi,<div><br></div><div>I am trying to setup the freeipa Active Directory trust setup and i am following </div><div>the <a href="http://www.freeipa.org/page/Active_Directory_trust_setup">http://www.freeipa.org/page/Active_Directory_trust_setup</a> documentation.</div><div><br></div><div>I am able to login on freeipa Server with <span style="color:rgb(46,52,54);font-family:"source sans pro",sans-serif;font-size:14px">AD users. </span></div><div><span style="color:rgb(46,52,54);font-family:"source sans pro",sans-serif;font-size:14px"><br></span></div><div><span style="color:rgb(46,52,54);font-family:"source sans pro",sans-serif;font-size:14px">But when i am trying to login with some other IPA </span><font color="#2e3436" face="source sans pro, sans-serif"><span style="font-size:14px">client machine I am not able to to login with AD user.</span></font></div><div><font color="#2e3436" face="source sans pro, sans-serif"><span style="font-size:14px"><br></span></font></div><div><font color="#2e3436" face="source sans pro, sans-serif"><span style="font-size:14px">Required firewall port is opened between freeipa server to AD server and freeipa server to freeipa clinets</span></font></div><div><span style="font-size:14px;color:rgb(46,52,54);font-family:"source sans pro",sans-serif"> </span></div><div><font color="#2e3436" face="source sans pro, sans-serif"><span style="font-size:14px">There is no firewall port is opened between from freeipa client to AD server.</span></font></div><div><br></div><div>=================================================================</div><div>against addomain from ipaserver :-<br></div><div><br></div><div><div>ipa01 ~]# KRB5_TRACE=/dev/stdout kinit <a href="mailto:rajat.g@AD.ADDOMAIN.COM">rajat.g@AD.ADDOMAIN.COM</a></div><div>[24633] 1476069033.462976: Resolving unique ccache of type KEYRING</div><div>[24633] 1476069033.463027: Getting initial credentials for <a href="mailto:rajat.g@AD.ADDOMAIN.COM">rajat.g@AD.ADDOMAIN.COM</a></div><div>[24633] 1476069033.465229: Sending request (183 bytes) to <a href="http://AD.ADDOMAIN.COM">AD.ADDOMAIN.COM</a></div><div>[24633] 1476069033.471891: Resolving hostname <a href="http://ad1.ad.addomain.com">ad1.ad.addomain.com</a></div><div>[24633] 1476069033.474439: Sending initial UDP request to dgram <a href="http://192.168.20.100:88">192.168.20.100:88</a></div><div>[24633] 1476069033.487765: Received answer (212 bytes) from dgram <a href="http://192.168.20.100:88">192.168.20.100:88</a></div><div>[24633] 1476069033.488098: Response was not from master KDC</div><div>[24633] 1476069033.488136: Received error from KDC: -1765328359/Additional pre-authentication required</div><div>[24633] 1476069033.488179: Processing preauth types: 16, 15, 19, 2</div><div>[24633] 1476069033.488192: Selected etype info: etype aes256-cts, salt "AD.ADDOMAIN.COMRajat.Gupta", params ""</div><div>[24633] 1476069033.488215: PKINIT client has no configured identity; giving up</div><div>[24633] 1476069033.488233: PKINIT client has no configured identity; giving up</div><div>[24633] 1476069033.488242: Preauth module pkinit (16) (real) returned: 22/Invalid argument</div><div>[24633] 1476069033.488250: PKINIT client has no configured identity; giving up</div><div>[24633] 1476069033.488255: Preauth module pkinit (14) (real) returned: 22/Invalid argument</div><div>Password for <a href="mailto:rajat.g@AD.ADDOMAIN.COM">rajat.g@AD.ADDOMAIN.COM</a>:</div></div><div><br></div><div><span style="color:rgb(46,52,54);font-family:"source sans pro",sans-serif;font-size:14px">this is working fine.</span><br></div><div><div>=================================================================</div></div><div><br></div><div><br></div><div><div>=================================================================</div></div><div>against addomain from ipaclinet :-<br></div><div><br></div><div><b><font color="#2e3436" face="source sans pro, sans-serif"><div><span style="font-size:14px">ipaclinet ~] # KRB5_TRACE=/dev/stdout kinit <a href="mailto:rajat.g@AD.ADDOMAIN.COM">rajat.g@AD.ADDOMAIN.COM</a></span></div><div><span style="font-size:14px">[4133] 1476067599.43421: Getting initial credentials for rajat.g@</span><span style="font-size:14px"><a href="http://AD.ADDOMAIN.COM">AD.ADDOMAIN.COM</a></span></div></font><font color="#2e3436" face="source sans pro, sans-serif"><div><span style="font-size:14px">[4133] 1476067599.43599: Sending request (183 bytes) to </span><span style="font-size:14px"><a href="http://AD.ADDOMAIN.COM">AD.ADDOMAIN.COM</a></span></div></font></b><font color="#2e3436" face="source sans pro, sans-serif"><div><span style="font-size:14px"><b>[4133] 1476067599.49544: Resolving hostname </b></span></div><div><span style="font-size:14px"><b><a href="http://ad1.ad.addomain.com">ad1.ad.addomain.com</a>.</b></span></div><div><span style="font-size:14px"><b>[4133] 1476067599.53762: Sending initial UDP request to dgram 192.168.20.100</b></span></div><div><span style="font-size:14px"><b><br></b></span></div><div><span style="font-size:14px">NOT WORKING</span></div><div><div style="color:rgb(34,34,34);font-family:arial,sans-serif">=================================================================</div></div><div><br></div><div><div style="color:rgb(34,34,34);font-family:arial,sans-serif">=================================================================</div></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif">against ipdomain from ipaclinet</span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif"><br></span></div><div><div><span style="font-size:14px"># KRB5_TRACE=/dev/stdout kinit admin@IPA.IPASERVER.LOCAL</span></div><div><span style="font-size:14px">[4914] 1476068067.763574: Getting initial credentials for admin@IPA.IPASERVER.LOCAL</span></div><div><span style="font-size:14px">[4914] 1476068067.763889: Sending request (177 bytes) to IPA.IPASERVER.LOCAL</span></div><div><span style="font-size:14px">[4914] 1476068067.764033: Initiating TCP connection to stream <a href="http://10.246.104.14:88">10.246.104.14:88</a></span></div><div><span style="font-size:14px">[4914] 1476068067.765089: Sending TCP request to stream <a href="http://192.168.100.100:88">192.168.100.100:88</a></span></div><div><span style="font-size:14px">[4914] 1476068067.767593: Received answer (356 bytes) from stream <a href="http://192.168.100.100:88">192.168.100.100:88</a></span></div><div><span style="font-size:14px">[4914] 1476068067.767603: Terminating TCP connection to stream <a href="http://192.168.100.100:88">192.168.100.100:88</a></span></div><div><span style="font-size:14px">[4914] 1476068067.767661: Response was from master KDC</span></div><div><span style="font-size:14px">[4914] 1476068067.767685: Received error from KDC: -1765328359/Additional pre-authentication required</span></div><div><span style="font-size:14px">[4914] 1476068067.767730: Processing preauth types: 136, 19, 2, 133</span></div><div><span style="font-size:14px">[4914] 1476068067.767742: Selected etype info: etype aes256-cts, salt "k},(k&+qA)Mosf6z", params ""</span></div><div><span style="font-size:14px">[4914] 1476068067.767747: Received cookie: MIT</span></div><div><span style="font-size:14px">Password for admin@IPA.IPASERVER.LOCAL:</span></div><div style="font-size:14px"><br></div><div style="font-size:14px">this is working fine.</div></div><div><div style="color:rgb(34,34,34);font-family:arial,sans-serif">=================================================================</div></div><div><br></div><div><span style="font-size:14px"><br></span></div><div><span style="font-size:14px">it looks for password-based authentication requests, the IPA clients connect directly to the AD servers using Kerberos.</span><br></div><div><span style="font-size:14px"><br></span></div><div><span style="font-size:14px">then there is </span><span style="font-size:14px">port firewall opening required </span><span style="font-size:14px"> </span><span style="font-size:14px">between ipaclinet and AD Server as well. Is it required ? </span><span style="font-size:14px">OR I am doing something wrong.</span></div></font><font color="#2e3436" face="source sans pro, sans-serif"><div><span style="font-size:14px"><br></span></div><div><span style="font-size:14px">/Rajat</span></div><div><span style="font-size:14px"><br></span></div><div><span style="font-size:14px"><br></span></div><div style="font-size:14px"><br></div></font></div><div><font color="#2e3436" face="source sans pro, sans-serif"><span style="font-size:14px"><br></span></font></div><div> </div><div><br></div><div><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><b>Rajat Gupta<br> </b><b><img style="margin: 0pt 0.2ex; vertical-align: middle;" src="http://../1/e/330"></b></div></div> </div></div>