<div dir="ltr"><div>Hi Alexander</div><div> </div><div><br> </div><div class="gmail_quote">On Thu, Sep 11, 2014 at 4:38 PM, Alexander Bokovoy <span dir="ltr"><<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><span>On Thu, 11 Sep 2014, Traiano Welcome wrote:<br> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"> Hi List<br> <br> I'm currently working through the IPAv3 AD integration document at:<br> <br> <a href="http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup" target="_blank">http://www.freeipa.org/page/<u></u>Howto/IPAv3_AD_trust_setup</a><br> <br> <br> I've managed to establish a trust between the IdM and the AD server.<br> However, when I run the command:<br> <br> ---<br> [root@kwtpocidm001 ~]# ipa trustdomain-fetch "mhatest.local"<br> ipa: ERROR: unknown command 'trustdomain-fetch'<br> ---<br> <br> It would appear the 'trustdomain-fetch' command is not present anymore or<br> has been replaced with something else?<br> </blockquote></span> No, it was my mistake when I expanded the wiki few days ago. ;)<br> <br> # ipa trust 2>&1|grep ' trust'<br> trust-add Add new trust to use.<br> trust-del Delete a trust.<br> trust-fetch-domains Refresh list of the domains associated with the trust<br> trust-find Search for trusts.<br> trust-mod Modify a trust (for future use).<br> trust-show Display information about a trust.<br> trustconfig-mod Modify global trust configuration.<br> trustconfig-show Show global trust configuration.<br> trustdomain-del Remove infromation about the domain associated with the trust.<br> trustdomain-disable Disable use of IPA resources by the domain of the trust<br> trustdomain-enable Allow use of IPA resources by the domain of the trust<br> trustdomain-find Search domains of the trust<br> <br> I fixed the page to use proper one -- trust-fetch-domains.<span><br> <br></span></blockquote><div> </div><div> </div><div>Excellent. Thanks.</div><div> </div><div> </div><div> </div><div> </div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><span> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"> I speculate it's this:<br> <br> ---<br> [root@kwtpocidm001 ~]# ipa trust-fetch-domains "mhatest.local"<br> ipa: ERROR: AD domain controller complains about communication sequence. It<br> may mean unsynchronized time on both sides, for example<br> ---<br> <br> Is this correct?<br> <br> <br> If indeed "trust-fetch-domains" is the correct command, then .w.r.t this<br> error message:<br> <br> "ipa: ERROR: AD domain controller complains about communication sequence.<br> It may mean unsynchronized time on both sides, for example"<br> <br> a) Checked the time synch on the AD server and the RHEL 7 IdM server and<br> it's fine.<br> </blockquote></span> Check time zone. I've seen many times that time zone on test Windows<br> installs is set to PDT while your actual zone might be something<br> different; thus it gets out of sync.<span><br> <br></span></blockquote><div> </div><div> </div><div>Timezones appear synced/the same:</div><div> </div><div> - IPA server: Thu Sep 11 18:01:58 AST 2014 </div><div> - Windows AD server:Thursday, ‎September ‎11, ‎2014, 6:02:10 PM TZ: (UTC+03:00) Kuwait, Riyadh</div><div> </div><div> </div><div> </div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><span> <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"> b) Here's a snippet around the error when running ipa with "-d":<br> </blockquote></span> This one is not usable. You need to enable debugging on the server side.<br> See <a href="http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup#Debugging_trust" target="_blank">http://www.freeipa.org/page/<u></u>Howto/IPAv3_AD_trust_setup#<u></u>Debugging_trust</a><br> in the part where it talks about /usr/share/ipa/smb.conf.empty.<span class="HOEnZb"><font color="#888888"><br> <br></font></span></blockquote><div> </div><div> </div><div>I've attached the debug logs, I'd be thankful if you could find anything in them!</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><span class="HOEnZb"><font color="#888888"> -- <br> / Alexander Bokovoy<br> </font></span></blockquote></div><div> </div><div>Traiano Welcome</div><div><br> </div></div>