<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=us-ascii"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body bgcolor="white" lang="EN-US" link="blue" vlink="purple"> <div class="WordSection1"> That did it! Thank you so much for your assistance! The sync agreement went through successfully.<o:p></o:p> <o:p> </o:p> <div> Thanks,<o:p></o:p> Sara Kline<o:p></o:p> </div> <o:p> </o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Rich Megginson [mailto:rmeggins@redhat.com] Sent: Wednesday, May 16, 2012 6:15 PM To: Kline, Sara Cc: freeipa-users@redhat.com Subject: Re: [Freeipa-users] Problems replicating with Windows 2008 AD<o:p></o:p> </div> </div> <o:p> </o:p> On 05/16/2012 06:04 PM, Kline, Sara wrote: <o:p></o:p> I found the issue, it had to do with what Windows set the cn to, as opposed to what I thought the CN was. Once I figured out where that was set at I was able to fix it. Cn’s for us are usually the user id so that was where the disconnect was. Once I fixed that issue however I got another error. I am logged in as root on the FreeIPA server. When I run the ipa-manage-replica command I get:<o:p></o:p> Added CA certificate /etc/openldap/cacerts/winadcert.cer to certificate database for oly-infra-ldap1.prod.tnsi.com<o:p></o:p> INFO:root:AD Suffix is: DC=prod,DC=example,DC=com<o:p></o:p> Insufficient access<o:p></o:p> <o:p></o:p> I am not sure I understand why this is not working.<o:p></o:p> You have to set permissions for your AD user in order to use the DirSync control. See <a href="http://msdn.microsoft.com/en-us/library/ms677626%28VS.85%29.aspx">http://msdn.microsoft.com/en-us/library/ms677626%28VS.85%29.aspx</a> <o:p></o:p> To use the DirSync control, caller must have the "directory get changes" right assigned on the root of the partition being monitored. By default, this right is assigned to the Administrator and LocalSystem accounts on domain controllers. The caller must also have the <a href="http://msdn.microsoft.com/en-us/library/ms684354%28v=vs.85%29.aspx"> DS-Replication-Get-Changes</a> extended control access right. For more information about implementing a change-tracking mechanism for applications that must run under an account that does not have this right, see <a href="http://msdn.microsoft.com/en-us/library/ms677627%28v=vs.85%29.aspx">Polling for Changes Using USNChanged</a>. For more information about privileges, see <a href="http://msdn.microsoft.com/en-us/library/aa379306%28v=vs.85%29.aspx">Privileges</a>.<o:p></o:p> <o:p></o:p> <o:p></o:p> <div> Thanks,<o:p></o:p> Sara Kline<o:p></o:p> </div> <o:p></o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"> From: Rich Megginson [<a href="mailto:rmeggins@redhat.com">mailto:rmeggins@redhat.com</a>] Sent: Wednesday, May 16, 2012 4:12 PM To: Kline, Sara Cc: <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Subject: Re: [Freeipa-users] Problems replicating with Windows 2008 AD<o:p></o:p> </div> </div> <o:p></o:p> On 05/16/2012 04:33 PM, Kline, Sara wrote: <o:p></o:p> Hey all,<o:p></o:p> FreeIPA has been very simple to setup so far, I have been able to follow along with the documentation every step of the way. I am running into an issue however when trying to set up replication between the Red Hat 6.2 server running FreeIPA and the Win 2008 R2 server running Active Directory. I created the replication user like the instructions say and gave it the necessary permissions, however when I try to set up the agreement, it tells me I am using invalid credentials. I am unsure of what I should do at this point? SSL Certs are installed on both and trusted on both, the servers are connected and both are synced to the same time source. Can anyone think of anything else?<o:p></o:p> I am using the command as follows:<o:p></o:p> Ipa-replica-manage connect –winsync<o:p></o:p> --binddn cn=freeipa,cn=users,dc=prod,dc=example,dc=com<o:p></o:p> --bindpw mypassword<o:p></o:p> --passsync mypassword<o:p></o:p> --cacert /etc/openldap/cacerts/winadcert.cer<o:p></o:p> oly-infra-ldap2.prod.example.com<o:p></o:p> You can use ldapsearch to test the connection with AD: LDAPTLS_CACERTDIR=/etc/dirsrv/slapd-YOUR-DOMAIN ldapsearch -xLLL -H <a href="ldap://oly-infra-ldap2.prod.example.com"> ldap://oly-infra-ldap2.prod.example.com</a> -ZZ -D "cn=freeipa,cn=users,dc=prod,dc=example,dc=com" -w mypassword -s base -b "" 'objectclass=*' namingcontexts This assumes 1) oly-infra-ldap2.prod.example.com is the correct FQDN of your AD machine 2) cn=freeipa,cn=users,dc=prod,dc=example,dc=com is a valid AD user in AD 3) mypassword is the correct password and doesn't need to be quoted for the shell <o:p></o:p> <o:p></o:p> Sara Kline<o:p></o:p> System Administrator<o:p></o:p> Transaction Network Services, Inc<o:p></o:p> 4501 Intelco Loop, Lacey WA 98503<o:p></o:p> Wk: (360) 493-6736<o:p></o:p> Cell: (360) 280-2495<o:p></o:p> <o:p></o:p> <o:p></o:p> <div class="MsoNormal" align="center" style="text-align:center"> <hr size="2" width="100%" align="center"> </div> This e-mail message is for the sole use of the intended recipient(s)and may contain confidential and privileged information of Transaction Network Services. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. <o:p></o:p> <pre>_______________________________________________<o:p></o:p></pre> <pre>Freeipa-users mailing list<o:p></o:p></pre> <pre><a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><o:p></o:p></pre> <pre><a href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a><o:p></o:p></pre> <o:p></o:p> <o:p> </o:p> <div class="MsoNormal" align="center" style="text-align:center"> <hr size="2" width="100%" align="center"> </div> This e-mail message is for the sole use of the intended recipient(s)and may contain confidential and privileged information of Transaction Network Services. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.<o:p></o:p> <o:p> </o:p> </div> <hr> This e-mail message is for the sole use of the intended recipient(s)and may contain confidential and privileged information of Transaction Network Services. Any unauthorised review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. </body> </html>