<div dir="ltr">hey guys,<div><br></div><div>so at this point in time we haven't been having any issues, but I am not 100% if the odd issues we have been having have been related to 2003 vs 2008 issue</div><div><br></div>
<div style>when we joined our IPA server to the 2003r2 we got the following output</div><div style><br></div><div style><div>[root@didmsvrua01 ~]# ipa trust-add --type=ad <a href="http://corpnonprd.xxxx.com">corpnonprd.xxxx.com</a> --admin Administrator --password</div>
<div>Active directory domain administrator's password:</div><div>--------------------------------------------------------------</div><div>Added Active Directory trust for realm "<a href="http://CorpNonPrd.xxxx.com">CorpNonPrd.xxxx.com</a>"</div>
<div>--------------------------------------------------------------</div><div> Realm name: <a href="http://CorpNonPrd.xxxx.com">CorpNonPrd.xxxx.com</a></div><div> Domain NetBIOS name: CORPNONPRD</div><div> Domain Security Identifier: S-1-5-21-417068303-3117552414-2168216644</div>
<div> Trust direction: Two-way trust</div><div> Trust type: Active Directory domain</div><div> Trust status: Established and verified</div><div>[root@didmsvrua01 ~]#</div><div><br></div><div><br></div><div style>This looks slightly different than yours, does this look like a properly established trust? I don't' seem to have any issues in regards to AES, and trust users can log into clients however there are issues where the first attempt takes a long time to login to the point of timeout and the second one works </div>
<div style><br></div><div style>Aly</div><div style><br></div><div style><br></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Jun 19, 2013 at 12:47 PM, Alexander Bokovoy <span dir="ltr"><<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On Wed, 19 Jun 2013, Dmitri Pal wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 06/19/2013 12:35 PM, Alexander Bokovoy wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On Wed, 19 Jun 2013, Aly Khimji wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
So as others have mentioned windows obviously isn't my area of focus<br>
here<br>
either, however we have this working with 2003r2, but I do notice odd<br>
behaviour with "id" returning odd results sometimes depending on what<br>
system I am logged in from or initial logins failing the first time and<br>
working the second time, would this be a result of 2003 trust vs 2008<br>
trust?<br>
</blockquote>
Ok, so I have tried another time and went through Windows Server 2003 R2<br>
setup again.<br>
<br>
You need to select domain functional level Windows Server 2003 and after<br>
that raise forest functional level to Windows Server 2003.<br>
<br>
Only in this case it will work, though without AES encryption (only RC4<br>
encryption is available).<br>
<br>
See <a href="http://technet.microsoft.com/en-us/library/cc738822%28v=ws.10%29.aspx" target="_blank">http://technet.microsoft.com/<u></u>en-us/library/cc738822%28v=ws.<u></u>10%29.aspx</a><br>
for Windows specifics.<br>
<br>
In order to raise forest functional level one needs to open 'Active<br>
Directory Domains and Trusts' snap-in and right-click on 'Active<br>
Directory Domains and Trusts' root in the left pane. Then select 'Raise<br>
forest functional level ...' and use "Windows Server 2003" as the level<br>
to raise.<br>
<br>
After that you can try establishing trust from IPA side.<br>
<br>
Here is IPA behavior (the output corresponds to FreeIPA 3.2 but behavior<br>
should be the same in RHEL 6.4):<br>
<br>
# ipa trust-add ad.domain --admin Administrator --password<br>
Active directory domain administrator's password: ipa: ERROR: invalid<br>
'AD domain controller': unsupported functional level<br>
<br>
(went and raised forest functional level)<br>
# ipa trust-add ad.domain --admin Administrator<br>
--password<br>
Active directory domain administrator's password:<br>
------------------------------<u></u>--------------------<br>
Added Active Directory trust for realm "ad.domain"<br>
------------------------------<u></u>--------------------<br>
Realm name: ad.domain<br>
Domain NetBIOS name: ADP<br>
Domain Security Identifier: S-1-5-21-426902846-1951547570-<u></u>376736459<br>
SID blacklist incoming: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2,<br>
S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7,<br>
S-1-5-8, S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12,<br>
S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16,<br>
S-1-5-17,<br>
S-1-5-18, S-1-5-19, S-1-5-20<br>
SID blacklist outgoing: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2,<br>
S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7,<br>
S-1-5-8, S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12,<br>
S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16,<br>
S-1-5-17,<br>
S-1-5-18, S-1-5-19, S-1-5-20<br>
Trust direction: Two-way trust<br>
Trust type: Active Directory domain<br>
Trust status: Established and verified<br>
<br>
<br>
Note that there will be all kinds of issues due to AES encryption keys<br>
are missing -- you would not be able to use IPA credentials to obtain<br>
Kerberos tickets against Windows services, for example. This whole<br>
experiment is rather of a limited value.<br>
<br>
But at least, log-in with PuTTY 0.62 works.<br>
<br>
</blockquote>
<br>
Should we put this on wiki as a how to?<br>
</blockquote></div></div>
Definitely. If nobody beats me through the night, adding it to<br>
<a href="http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup" target="_blank">http://www.freeipa.org/page/<u></u>Howto/IPAv3_AD_trust_setup</a>, I'll do it<br>
tomorrow.<span class="HOEnZb"><font color="#888888"><br>
<br>
<br>
-- <br>
/ Alexander Bokovoy</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
______________________________<u></u>_________________<br>
Freeipa-users mailing list<br>
<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/<u></u>mailman/listinfo/freeipa-users</a><br>
</div></div></blockquote></div><br></div>