<div dir="ltr">Hi please find below output<div><br></div><div><div>[root@kwttstfreipa01 ~]# kinit admin</div><div>Password for admin@SOLIPA.LOCAL:</div><div><br></div><div>[root@kwttstfreipa01 ~]# id admin</div><div>uid=756800000(admin) gid=756800000(admins) groups=756800000(admins)</div></div><div><br></div><div><br></div><div><div>[root@kwttstfreipa01 ~]# KRB5_TRACE=/dev/stderr kvno -S cifs <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a></div><div>[16898] 1425327238.662939: Convert service cifs (service with host as instance) on host <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a> to principal</div><div>[16898] 1425327238.663650: Remote host after forward canonicalization: <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a></div><div>[16898] 1425327238.663684: Remote host after reverse DNS processing: <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a></div><div>[16898] 1425327238.663728: Get host realm for <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a></div><div>[16898] 1425327238.663742: Use local host <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a> to get host realm</div><div>[16898] 1425327238.663749: Look up <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a> in the domain_realm map</div><div>[16898] 1425327238.663757: Look up .<a href="http://kwttestdc.com">kwttestdc.com</a> in the domain_realm map</div><div>[16898] 1425327238.663764: Temporary realm is <a href="http://KWTTESTDC.COM">KWTTESTDC.COM</a></div><div>[16898] 1425327238.663771: Got realm <a href="http://KWTTESTDC.COM">KWTTESTDC.COM</a> for host <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a></div><div>[16898] 1425327238.663792: Got service principal cifs/<a href="mailto:kwttestdc001.kwttestdc.com@KWTTESTDC.COM">kwttestdc001.kwttestdc.com@KWTTESTDC.COM</a></div><div>[16898] 1425327238.663818: Getting credentials admin@SOLIPA.LOCAL -> cifs/<a href="mailto:kwttestdc001.kwttestdc.com@KWTTESTDC.COM">kwttestdc001.kwttestdc.com@KWTTESTDC.COM</a> using ccache KEYRING:persistent:0:0</div><div>[16898] 1425327238.664257: Retrieving admin@SOLIPA.LOCAL -> cifs/<a href="mailto:kwttestdc001.kwttestdc.com@KWTTESTDC.COM">kwttestdc001.kwttestdc.com@KWTTESTDC.COM</a> from KEYRING:persistent:0:0 with result: -1765328243/Matching credential not found</div><div>[16898] 1425327238.664381: Retrieving admin@SOLIPA.LOCAL -> krbtgt/KWTTESTDC.COM@SOLIPA.LOCAL from KEYRING:persistent:0:0 with result: -1765328243/Matching credential not found</div><div>[16898] 1425327238.664500: Retrieving admin@SOLIPA.LOCAL -> krbtgt/SOLIPA.LOCAL@SOLIPA.LOCAL from KEYRING:persistent:0:0 with result: 0/Success</div><div>[16898] 1425327238.664516: Starting with TGT for client realm: admin@SOLIPA.LOCAL -> krbtgt/SOLIPA.LOCAL@SOLIPA.LOCAL</div><div>[16898] 1425327238.664608: Retrieving admin@SOLIPA.LOCAL -> krbtgt/KWTTESTDC.COM@SOLIPA.LOCAL from KEYRING:persistent:0:0 with result: -1765328243/Matching credential not found</div><div>[16898] 1425327238.664622: Requesting TGT krbtgt/KWTTESTDC.COM@SOLIPA.LOCAL using TGT krbtgt/SOLIPA.LOCAL@SOLIPA.LOCAL</div><div>[16898] 1425327238.664690: Generated subkey for TGS request: aes256-cts/F74E</div><div>[16898] 1425327238.664818: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts</div><div>[16898] 1425327238.665062: Encoding request body and padata into FAST request</div><div>[16898] 1425327238.665256: Sending request (1486 bytes) to SOLIPA.LOCAL</div><div>[16898] 1425327238.665597: Initiating TCP connection to stream <a href="http://172.16.107.250:88">172.16.107.250:88</a></div><div>[16898] 1425327238.665802: Sending TCP request to stream <a href="http://172.16.107.250:88">172.16.107.250:88</a></div><div>[16898] 1425327238.673061: Received answer from stream <a href="http://172.16.107.250:88">172.16.107.250:88</a></div><div>[16898] 1425327238.673285: Response was from master KDC</div><div>[16898] 1425327238.673342: Decoding FAST response</div><div>[16898] 1425327238.673574: FAST reply key: aes256-cts/9134</div><div>[16898] 1425327238.673650: TGS reply is for admin@SOLIPA.LOCAL -> krbtgt/KWTTESTDC.COM@SOLIPA.LOCAL with session key aes256-cts/4F6F</div><div>[16898] 1425327238.673691: TGS request result: 0/Success</div><div>[16898] 1425327238.673753: Removing admin@SOLIPA.LOCAL -> krbtgt/KWTTESTDC.COM@SOLIPA.LOCAL from KEYRING:persistent:0:0</div><div>[16898] 1425327238.673768: Storing admin@SOLIPA.LOCAL -> krbtgt/KWTTESTDC.COM@SOLIPA.LOCAL in KEYRING:persistent:0:0</div><div>[16898] 1425327238.673933: Received TGT for service realm: krbtgt/KWTTESTDC.COM@SOLIPA.LOCAL</div><div>[16898] 1425327238.673950: Requesting tickets for cifs/<a href="mailto:kwttestdc001.kwttestdc.com@KWTTESTDC.COM">kwttestdc001.kwttestdc.com@KWTTESTDC.COM</a>, referrals on</div><div>[16898] 1425327238.673998: Generated subkey for TGS request: aes256-cts/8623</div><div>[16898] 1425327238.674084: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts</div><div>[16898] 1425327238.674238: Encoding request body and padata into FAST request</div><div>[16898] 1425327238.674395: Sending request (1531 bytes) to <a href="http://KWTTESTDC.COM">KWTTESTDC.COM</a></div><div>[16898] 1425327238.676086: Resolving hostname <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a>.</div><div>[16898] 1425327238.678096: Resolving hostname <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a>.</div><div>[16898] 1425327238.678907: Initiating TCP connection to stream <a href="http://172.16.104.231:88">172.16.104.231:88</a></div><div>[16898] 1425327238.679404: Sending TCP request to stream <a href="http://172.16.104.231:88">172.16.104.231:88</a></div><div>[16898] 1425327238.681292: Received answer from stream <a href="http://172.16.104.231:88">172.16.104.231:88</a></div><div>[16898] 1425327238.682088: Response was not from master KDC</div><div>[16898] 1425327238.682142: TGS request result: -1765328372/KDC policy rejects request</div><div>[16898] 1425327238.682161: Requesting tickets for cifs/<a href="mailto:kwttestdc001.kwttestdc.com@KWTTESTDC.COM">kwttestdc001.kwttestdc.com@KWTTESTDC.COM</a>, referrals off</div><div>[16898] 1425327238.682212: Generated subkey for TGS request: aes256-cts/50DA</div><div>[16898] 1425327238.682283: etypes requested in TGS request: aes256-cts, aes128-cts, des3-cbc-sha1, rc4-hmac, camellia128-cts, camellia256-cts</div><div>[16898] 1425327238.682391: Encoding request body and padata into FAST request</div><div>[16898] 1425327238.682499: Sending request (1531 bytes) to <a href="http://KWTTESTDC.COM">KWTTESTDC.COM</a></div><div>[16898] 1425327238.683871: Resolving hostname <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a>.</div><div>[16898] 1425327238.684756: Resolving hostname <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a>.</div><div>[16898] 1425327238.685461: Initiating TCP connection to stream <a href="http://172.16.104.231:88">172.16.104.231:88</a></div><div>[16898] 1425327238.685864: Sending TCP request to stream <a href="http://172.16.104.231:88">172.16.104.231:88</a></div><div>[16898] 1425327238.687136: Received answer from stream <a href="http://172.16.104.231:88">172.16.104.231:88</a></div><div>[16898] 1425327238.687793: Response was not from master KDC</div><div>[16898] 1425327238.687832: TGS request result: -1765328372/KDC policy rejects request</div><div>kvno: KDC policy rejects request while getting credentials for cifs/<a href="mailto:kwttestdc001.kwttestdc.com@KWTTESTDC.COM">kwttestdc001.kwttestdc.com@KWTTESTDC.COM</a></div></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Mar 2, 2015 at 11:11 PM, Alexander Bokovoy <span dir="ltr"><<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Mon, 02 Mar 2015, Ben .T.George wrote:<br> </span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> HI<br> <br> trust was successful<br> <br> ipa trust-add --type=ad *ad_domain* --admin Administrator --password<span class=""><br> <br> and i got output like below<br> <br> Active directory domain administrator's password:<br> ------------------------------<u></u>------------------------<br> Added Active Directory trust for realm "<a href="http://KWTTESTDC.COM" target="_blank">KWTTESTDC.COM</a>"<br> ------------------------------<u></u>------------------------<br> Realm name: <a href="http://KWTTESTDC.COM" target="_blank">KWTTESTDC.COM</a><br> Domain NetBIOS name: KWTTESTDC<br> Domain Security Identifier: S-1-5-21-3779563847-208264455-<u></u>1888173826<br> SID blacklist incoming: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2,<br> S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7, S-1-5-8, S-1-5-9, S-1-5-10,<br> S-1-5-11,<br> S-1-5-12, S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16,<br> S-1-5-17, S-1-5-18, S-1-5-19, S-1-5-20<br> SID blacklist outgoing: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2,<br> S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7, S-1-5-8, S-1-5-9, S-1-5-10,<br> S-1-5-11,<br> S-1-5-12, S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16,<br> S-1-5-17, S-1-5-18, S-1-5-19, S-1-5-20<br> Trust direction: Two-way trust<br> Trust type: Active Directory domain<br> Trust status: Established and verified<br> <br> this is what it should give noe?<br> <br> How can i check the trust is correct or not.?<br> </span></blockquote> Try:<br> <br> $ kinit admin<br> $ KRB5_TRACE=/dev/stderr kvno -S cifs ad.domain.controller.fqdn<br> <br> and show the output.<span class="HOEnZb"><font color="#888888"><br> <br> -- <br> / Alexander Bokovoy<br> </font></span></blockquote></div><br></div>