<div dir="rtl"><div dir="ltr" style="text-align:left">Thank you for the help! </div><div dir="ltr" style="text-align:left">I have preformed downgrade: yum downgrade samba4* [root@ipaserver1 ~]# rpm -qa | grep samb samba4-python-4.0.0-58.el6.rc4.x86_64 samba4-winbind-4.0.0-58.el6.rc4.x86_64 samba4-common-4.0.0-58.el6.rc4.x86_64 samba4-winbind-clients-4.0.0-58.el6.rc4.x86_64 samba4-libs-4.0.0-58.el6.rc4.x86_64 samba4-client-4.0.0-58.el6.rc4.x86_64 samba4-4.0.0-58.el6.rc4.x86_64 </div><div dir="ltr" style="text-align:left">And it worked ! </div><div dir="ltr" style="text-align:left">I am now able to perform login via "ssh" and su on to the ipaserver with AD users: [root@ipaserver1 ~]# su <a href="mailto:Genadi@ADEXAMPLE.COM">Genadi@ADEXAMPLE.COM</a> sh-4.1$ </div><div dir="ltr" style="text-align:left">and wbinfo and getent return values: [root@ipaserver1 ~]# wbinfo -u ADEXAMPLE\administrator ADEXAMPLE\guest ADEXAMPLE\genadi ADEXAMPLE\krbtgt ADEXAMPLE\linux$ ADEXAMPLE\daniel [root@ipaserver1 ~]# wbinfo -g admins editors default smb group ad_users ADEXAMPLE\domain computers ADEXAMPLE\domain controllers ADEXAMPLE\schema admins ADEXAMPLE\enterprise admins ADEXAMPLE\domain admins ADEXAMPLE\domain users ADEXAMPLE\domain guests ADEXAMPLE\group policy creator owners ADEXAMPLE\read-only domain controllers ADEXAMPLE\enterprise read-only domain controllers ADEXAMPLE\dnsupdateproxy </div><div dir="ltr" style="text-align:left">[root@ipaserver1 ~]# getent passwd <a href="mailto:Genadi@ADEXAMPLE.COM">Genadi@ADEXAMPLE.COM</a> genadi@adexample.com:*:699001000:699001000::/home/<a href="http://adexample.com/genadi">adexample.com/genadi</a>: </div><div dir="ltr" style="text-align:left">After this success, i have tried to execute a login on client machine (using AD user), but it did not work: [root@ipaclient1 ~]# su <a href="mailto:Genadi@ADEXAMPLE.COM">Genadi@ADEXAMPLE.COM</a> su: user <a href="mailto:Genadi@ADEXAMPLE.COM">Genadi@ADEXAMPLE.COM</a> does not exist </div><div dir="ltr" style="text-align:left"> Also wbinfo and getent do not return value: </div><div dir="ltr" style="text-align:left"> [root@ipaclient1 ~]# wbinfo -u [root@ipaclient1 ~]# wbinfo -g [root@ipaclient1 ~]# getent passwd <a href="mailto:Genadi@ADEXAMPLE.COM">Genadi@ADEXAMPLE.COM</a> </div><div dir="ltr" style="text-align:left"><div style="text-align:left">Therefore i have preformed downgrade: yum downgrade samba4* [root@ipaclient1 ~]# rpm -qa | grep samb samba-winbind-clients-3.6.9-167.el6_5.x86_64 samba-common-3.6.9-167.el6_5.x86_64 samba-winbind-3.6.9-167.el6_5.x86_64 samba4-libs-4.0.0-58.el6.rc4.x86_64 </div><div style="text-align:left">After the downgrade the login attempt still failed: </div>[root@ipaclient1 ~]# su <a href="mailto:Genadi@ADEXAMPLE.COM">Genadi@ADEXAMPLE.COM</a> su: user <a href="mailto:Genadi@ADEXAMPLE.COM">Genadi@ADEXAMPLE.COM</a> does not exist </div><div dir="ltr" style="text-align:left"> I wonder if the fact that ipa-windbind-client is 3.6.9, is the cause. </div><div dir="ltr" style="text-align:left">Also here are the client configuration file: </div><div dir="ltr" style="text-align:left"> </div><div dir="ltr" style="text-align:left">sssd </div><div dir="ltr" style="text-align:left">[root@ipaclient1 ~]# cat /etc/sssd/sssd.conf [domain/<a href="http://linux.adexample.com">linux.adexample.com</a>] cache_credentials = True krb5_store_password_if_offline = True ipa_domain = <a href="http://linux.adexample.com">linux.adexample.com</a> id_provider = ipa auth_provider = ipa access_provider = ipa ipa_hostname = <a href="http://ipaclient1.linux.adexample.com">ipaclient1.linux.adexample.com</a> chpass_provider = ipa ipa_dyndns_update = True ipa_server = _srv_, <a href="http://ipaserver1.linux.adexample.com">ipaserver1.linux.adexample.com</a> ldap_tls_cacert = /etc/ipa/ca.crt subdomains_provider = ipa [sssd] services = nss, pam, ssh, pac config_file_version = 2 domains = <a href="http://linux.adexample.com">linux.adexample.com</a> [nss] [pam] [sudo] [autofs] [ssh] [pac] </div><div dir="ltr" style="text-align:left">krb5 [root@ipaclient1 ~]# cat /etc/krb5.conf #File modified by ipa-client-install includedir /var/lib/sss/pubconf/krb5.include.d/ [libdefaults] default_realm = <a href="http://LINUX.ADEXAMPLE.COM">LINUX.ADEXAMPLE.COM</a> dns_lookup_realm = true dns_lookup_kdc = true rdns = false ticket_lifetime = 24h forwardable = yes [realms] <a href="http://LINUX.ADEXAMPLE.COM">LINUX.ADEXAMPLE.COM</a> = { pkinit_anchors = FILE:/etc/ipa/ca.crt auth_to_local = RULE:[1:$1@$0](^.*@<a href="http://ADEXAMPLE.COM">ADEXAMPLE.COM</a>$)s/@<a href="http://ADEXAMPLE.COM/@adexample.com/">ADEXAMPLE.COM/@adexample.com/</a> auth_to_local = DEFAULT } [domain_realm] .<a href="http://linux.adexample.com">linux.adexample.com</a> = <a href="http://LINUX.ADEXAMPLE.COM">LINUX.ADEXAMPLE.COM</a> <a href="http://linux.adexample.com">linux.adexample.com</a> = <a href="http://LINUX.ADEXAMPLE.COM">LINUX.ADEXAMPLE.COM</a> </div><div dir="ltr" style="text-align:left">And again - Thanks you. I was stuck on it for log time. </div><div dir="ltr" style="text-align:left"> </div></div><div class="gmail_extra"> <div class="gmail_quote"> <div dir="ltr">2014-02-17 10:34 GMT+02:00 Sumit Bose <<a href="mailto:sbose@redhat.com" target="_blank">sbose@redhat.com</a>>:</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div class="HOEnZb"><div class="h5">On Sat, Feb 15, 2014 at 12:14:58AM +0200, Genadi Postrilko wrote: > I have seen threads where opened on trust issues: > "AD - Freeipa trust confusion" > "Cross domain trust" > "Cannot loging via SSH with AD user TO IPA Domain" - which I opened. > > It looks like after creation of trust, TGT ticket can be issued from AD, > but "su" and "ssh" do not allow a log in with AD user. > I'm not sure if a conclusion has been reached on this subject. > > I gave it a try again and attempted to create a trust with IPA as a DNS > subdomain of AD. > I followed : > <a href="https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/trust-ipa-subdomain.html" target="_blank">https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/trust-ipa-subdomain.html</a> > > AD domain: <a href="http://ADEXAMPLE.COM" target="_blank">ADEXAMPLE.COM</a> > IPA subdoamin: <a href="http://LINUX.ADEXAMPLE.COM" target="_blank">LINUX.ADEXAMPLE.COM</a> > > When i finished the necessary steps i attempted to retrieve a TGT from AD > (while logged in to IPA server): > > [root@ipaserver1 sbin]# kinit <a href="mailto:Administrator@ADEXAMPLE.COM">Administrator@ADEXAMPLE.COM</a> > Password for <a href="mailto:Administrator@ADEXAMPLE.COM">Administrator@ADEXAMPLE.COM</a>: > [root@ipaserver1 sbin]# klist > Ticket cache: FILE:/tmp/krb5cc_0 > Default principal: <a href="mailto:Administrator@ADEXAMPLE.COM">Administrator@ADEXAMPLE.COM</a> > > Valid starting Expires Service principal > 02/14/14 07:50:21 02/14/14 17:50:20 krbtgt/<a href="mailto:ADEXAMPLE.COM@ADEXAMPLE.COM">ADEXAMPLE.COM@ADEXAMPLE.COM</a> > renew until 02/15/14 07:50:21 > > But logging in by "ssh" and "su" ended in failure: > > login as: <a href="mailto:Administrator@ADEXAMPLE.COM">Administrator@ADEXAMPLE.COM</a> > Administrator@ADDC.COM@<a href="http://192.168.227.201" target="_blank">192.168.227.201</a>'s password: > Access denied > > After reading > <a href="http://www.freeipa.org/page/IPAv3_testing_AD_trust#Create_a_trust_to_an_AD_domaini" target="_blank">http://www.freeipa.org/page/IPAv3_testing_AD_trust#Create_a_trust_to_an_AD_domaini</a> > did the following on the AD server: > > Administrative Tools -> Active Directory Domains and Trust -> </div></div>> <a href="http://adexample.com" target="_blank">adexample.com</a>(right click) -> Properties -> Trust -> Domain Trusted by <div class="">> this domain > (outgoing trust) -> Properties -> General -> Validate > </div>> *After doing this i was able to login via "ssh" and "su" with > "Administrator" **user :* <div class="">> > login as: <a href="mailto:Administrator@ADEXAMPLE.COM">Administrator@ADEXAMPLE.COM</a> > Administrator@ADEXAMPLE.COM@<a href="http://192.168.227.201" target="_blank">192.168.227.201</a>'s password: > Last login: Wed Feb 12 14:39:49 2014 from 192.168.227.1 > Could not chdir to home directory /home/<a href="http://adexample.com/administrator" target="_blank">adexample.com/administrator</a>: No > such file or directory > /usr/bin/xauth: error in locking authority file /home/ > <a href="http://adexample.com/administrator/.Xauthority" target="_blank">adexample.com/administrator/.Xauthority</a> > -sh-4.1$ > </div>> *But still not able to login with other AD accounts:* <div class="">> > [root@ipaserver1 sbin]# su <a href="mailto:Genadi@ADEXAMPLE.COM">Genadi@ADEXAMPLE.COM</a> > su: user <a href="mailto:Genadi@ADEXAMPLE.COM">Genadi@ADEXAMPLE.COM</a> does not exist > > After reading the other threads, ill try and provide as much information as > i can: > </div>> *wbinfo -u does not return values.* <div class="">> [root@ipaserver1 sbin]# wbinfo -u > [root@ipaserver1 sbin]# > </div>> *wbinfo -u output:* <div class="">> [root@ipaserver1 sbin]# wbinfo -g > admins > editors > default smb group > ad_users > </div>> *wbinfo --online-status shows ADEXAMPLE is offline* <div class="">> [root@ipaserver1 ~]# wbinfo --online-status > BUILTIN : online > LINUX : online > ADEXAMPLE : offline > </div>> *getent for Administrator does return value.* <div class="">> [root@ipaserver1 sbin]# getent passwd <a href="mailto:Administrator@ADEXAMPLE.COM">Administrator@ADEXAMPLE.COM</a> > administrator@adexample.com:*:699000500:699000500::/home/ > <a href="http://adexample.com/administrator" target="_blank">adexample.com/administrator</a>: > </div>> *getent for other AD users does not return value.* <div class="">> [root@ipaserver1 sbin]# getent passwd <a href="mailto:Genadi@ADEXAMPLE.COM">Genadi@ADEXAMPLE.COM</a> > [root@ipaserver1 sbin]# > > </div>> *System info/configurations:* <div><div class="h5">> > [root@ipaserver1 ~]# cat /etc/redhat-release > Red Hat Enterprise Linux Server release 6.2 Beta (Santiago) > > [root@ipaserver1 sbin]# rpm -qa | grep ipa > ipa-python-3.0.0-37.el6.x86_64 > ipa-client-3.0.0-37.el6.x86_64 > libipa_hbac-python-1.9.2-129.el6.x86_64 > ipa-pki-common-theme-9.0.3-7.el6.noarch > ipa-server-trust-ad-3.0.0-37.el6.x86_64 > libipa_hbac-1.9.2-129.el6.x86_64 > ipa-admintools-3.0.0-37.el6.x86_64 > ipa-server-selinux-3.0.0-37.el6.x86_64 > ipa-pki-ca-theme-9.0.3-7.el6.noarch > ipa-server-3.0.0-37.el6.x86_64 > python-iniparse-0.3.1-2.1.el6.noarch > > [root@ipaserver1 ~]# rpm -qa | grep sssd > sssd-1.9.2-129.el6.x86_64 > sssd-client-1.9.2-129.el6.x86_64 > > [root@ipaserver1 sbin]# rpm -qa | grep samb > samba4-common-4.0.0-60.el6_5.rc4.x86_64 > samba4-winbind-clients-4.0.0-60.el6_5.rc4.x86_64 > samba4-libs-4.0.0-60.el6_5.rc4.x86_64 > samba4-python-4.0.0-60.el6_5.rc4.x86_64 > samba4-4.0.0-60.el6_5.rc4.x86_64 > samba4-client-4.0.0-60.el6_5.rc4.x86_64 > samba4-winbind-4.0.0-60.el6_5.rc4.x86_64 </div></div>Thank you very much for the detailed report. Looks like you are hit by the 'NT_STATUS_INVALID_PARAMETER_MIX' issue (see log.wb-ADEXAMPLE). We are currently investigating this issue. I you would like to help it would be nice if you can try to downgrade the samba4 packages to the -58 release and see if this works any better for you. Currently I'll try tor reproduce this issue locally and will give you an update as soon as I find anything which might help to get around this issue. bye, Sumit > > *SSSD* <div><div class="h5">> > [root@ipaserver1 ~]# cat /etc/sssd/sssd.conf > [domain/<a href="http://linux.adexample.com" target="_blank">linux.adexample.com</a>] > > cache_credentials = True > krb5_store_password_if_offline = True > ipa_domain = <a href="http://linux.adexample.com" target="_blank">linux.adexample.com</a> > id_provider = ipa > auth_provider = ipa > access_provider = ipa > ipa_hostname = <a href="http://ipaserver1.linux.adexample.com" target="_blank">ipaserver1.linux.adexample.com</a> > chpass_provider = ipa > ipa_server = <a href="http://ipaserver1.linux.adexample.com" target="_blank">ipaserver1.linux.adexample.com</a> > ldap_tls_cacert = /etc/ipa/ca.crt > subdomains_provider = ipa > debug_level = 6 > [sssd] > services = nss, pam, ssh, pac > config_file_version = 2 > > domains = <a href="http://linux.adexample.com" target="_blank">linux.adexample.com</a> > debug_level = 6 > [nss] > debug_level = 6 > [pam] > debug_level = 6 > [sudo] > debug_level = 6 > [autofs] > debug_level = 6 > [ssh] > debug_level = 6 > [pac] > debug_level = 6 > </div></div>> *KRB5* <div><div class="h5">> > [root@ipaserver1 ~]# cat /etc/krb5.conf > includedir /var/lib/sss/pubconf/krb5.include.d/ > > [logging] > default = FILE:/var/log/krb5libs.log > kdc = FILE:/var/log/krb5kdc.log > admin_server = FILE:/var/log/kadmind.log > > [libdefaults] > default_realm = <a href="http://LINUX.ADEXAMPLE.COM" target="_blank">LINUX.ADEXAMPLE.COM</a> > dns_lookup_realm = false > dns_lookup_kdc = true > rdns = false > ticket_lifetime = 24h > forwardable = yes > > [realms] > <a href="http://LINUX.ADEXAMPLE.COM" target="_blank">LINUX.ADEXAMPLE.COM</a> = { > kdc = <a href="http://ipaserver1.linux.adexample.com:88" target="_blank">ipaserver1.linux.adexample.com:88</a> > master_kdc = <a href="http://ipaserver1.linux.adexample.com:88" target="_blank">ipaserver1.linux.adexample.com:88</a> > admin_server = <a href="http://ipaserver1.linux.adexample.com:749" target="_blank">ipaserver1.linux.adexample.com:749</a> > default_domain = <a href="http://linux.adexample.com" target="_blank">linux.adexample.com</a> > pkinit_anchors = FILE:/etc/ipa/ca.crt > auth_to_local = RULE:[1:$1@$0](^.*@<a href="http://ADEXAMPLE.COM" target="_blank">ADEXAMPLE.COM</a>$)s/@ > <a href="http://ADEXAMPLE.COM/@adexample.com/" target="_blank">ADEXAMPLE.COM/@adexample.com/</a> > auth_to_local = DEFAULT > } > > [domain_realm] > .<a href="http://linux.adexample.com" target="_blank">linux.adexample.com</a> = <a href="http://LINUX.ADEXAMPLE.COM" target="_blank">LINUX.ADEXAMPLE.COM</a> > <a href="http://linux.adexample.com" target="_blank">linux.adexample.com</a> = <a href="http://LINUX.ADEXAMPLE.COM" target="_blank">LINUX.ADEXAMPLE.COM</a> > > [dbmodules] > <a href="http://LINUX.ADEXAMPLE.COM" target="_blank">LINUX.ADEXAMPLE.COM</a> = { > db_library = ipadb.so > } > > I have increased the debug level of the IPA components. </div></div>> Here are the logs (*krb5_child.log, **ldap_child.log, **log.smbd, > **log.wb-ADEXAMPLE, > **log.wb-LINUX, **log.winbindd, **log.winbindd-dc-connect, > log.winbindd-idmap*, *sssd.log*, *sssd_linux.adexample.com.log*,*sssd_nss.log, > **sssd_pac.log*, *sssd_pam.log, * > > > > *sssd_ssh.log, /var/log/secure):<a href="https://gist.github.com/anonymous/9006532" target="_blank">https://gist.github.com/anonymous/9006532</a> > <<a href="https://gist.github.com/anonymous/9006532" target="_blank">https://gist.github.com/anonymous/9006532</a>>* <div class="">> Any insights on why only Administrator is recognized by the Trust? And why > extra step on AD was needed? </div>> _______________________________________________ > Freeipa-users mailing list > <a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a> > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> </blockquote></div> </div>