<div dir="ltr">HI<div><br></div><div>i have re-installed IPA with latest 4.1 version.</div><div><br></div><div>installed packages by using <a href="https://copr.fedoraproject.org/coprs/mkosek/freeipa/">https://copr.fedoraproject.org/coprs/mkosek/freeipa/</a> repos</div><div><br></div><div># ipa-server-install went successfully without any error an it says the same on log files </div><div><br></div><div><div><i><font color="#0000ff">[root@kwtpocpbis01 ~]# kinit admin</font></i></div><div><i><font color="#0000ff">Password for admin@SOLIPA.LOCAL:</font></i></div><div><i><font color="#0000ff">[root@kwtpocpbis01 ~]# klist</font></i></div><div><i><font color="#0000ff">Ticket cache: KEYRING:persistent:0:0</font></i></div><div><i><font color="#0000ff">Default principal: admin@SOLIPA.LOCAL</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">Valid starting Expires Service principal</font></i></div><div><i><font color="#0000ff">03/04/2015 08:36:55 03/05/2015 08:36:51 krbtgt/SOLIPA.LOCAL@SOLIPA.LOCAL</font></i></div><div><i><font color="#0000ff">[root@kwtpocpbis01 ~]# geten</font></i></div><div><i><font color="#0000ff">getenforce getent</font></i></div><div><i><font color="#0000ff">[root@kwtpocpbis01 ~]# getent passwd admin</font></i></div><div><i><font color="#0000ff">admin:*:4400000:4400000:Administrator:/home/admin:/bin/bash</font></i></div></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff"># ipa-adtrust-install --netbios-name=SOLIPA -a Passw0rd</font></i> also successfully went .<br></div><div><br></div><div>DNS is working fine as expected.</div><div><i><font color="#0000ff"><br></font></i></div><div><div><i><font color="#0000ff">[root@kwtpocpbis01 ~]# dig SRV _ldap._<a href="http://tcp.kwttestdc.com">tcp.kwttestdc.com</a></font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">; <<>> DiG 9.9.4-RedHat-9.9.4-20.el7.centos.pkcs11 <<>> SRV _ldap._<a href="http://tcp.kwttestdc.com">tcp.kwttestdc.com</a></font></i></div><div><i><font color="#0000ff">;; global options: +cmd</font></i></div><div><i><font color="#0000ff">;; Got answer:</font></i></div><div><i><font color="#0000ff">;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26944</font></i></div><div><i><font color="#0000ff">;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 2</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">;; OPT PSEUDOSECTION:</font></i></div><div><i><font color="#0000ff">; EDNS: version: 0, flags:; udp: 4000</font></i></div><div><i><font color="#0000ff">;; QUESTION SECTION:</font></i></div><div><i><font color="#0000ff">;_ldap._<a href="http://tcp.kwttestdc.com">tcp.kwttestdc.com</a>. IN SRV</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">;; ANSWER SECTION:</font></i></div><div><i><font color="#0000ff">_ldap._<a href="http://tcp.kwttestdc.com">tcp.kwttestdc.com</a>. 600 IN SRV 0 100 389 <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a>.</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">;; ADDITIONAL SECTION:</font></i></div><div><i><font color="#0000ff"><a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a>. 3600 IN A 172.16.104.231</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">;; Query time: 0 msec</font></i></div><div><i><font color="#0000ff">;; SERVER: 172.16.104.231#53(172.16.104.231)</font></i></div><div><i><font color="#0000ff">;; WHEN: Wed Mar 04 08:41:26 AST 2015</font></i></div><div><i><font color="#0000ff">;; MSG SIZE rcvd: 115</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">[root@kwtpocpbis01 ~]# dig SRV _ldap._tcp.solipa.local</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">; <<>> DiG 9.9.4-RedHat-9.9.4-20.el7.centos.pkcs11 <<>> SRV _ldap._tcp.solipa.local</font></i></div><div><i><font color="#0000ff">;; global options: +cmd</font></i></div><div><i><font color="#0000ff">;; Got answer:</font></i></div><div><i><font color="#0000ff">;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6196</font></i></div><div><i><font color="#0000ff">;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 2</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">;; OPT PSEUDOSECTION:</font></i></div><div><i><font color="#0000ff">; EDNS: version: 0, flags:; udp: 4000</font></i></div><div><i><font color="#0000ff">;; QUESTION SECTION:</font></i></div><div><i><font color="#0000ff">;_ldap._tcp.solipa.local. IN SRV</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">;; ANSWER SECTION:</font></i></div><div><i><font color="#0000ff">_ldap._tcp.solipa.local. 11944 IN SRV 0 100 389 kwtpocpbis01.solipa.local.</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">;; ADDITIONAL SECTION:</font></i></div><div><i><font color="#0000ff">kwtpocpbis01.solipa.local. 1200 IN A 172.16.107.244</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">;; Query time: 2 msec</font></i></div><div><i><font color="#0000ff">;; SERVER: 172.16.104.231#53(172.16.104.231)</font></i></div><div><i><font color="#0000ff">;; WHEN: Wed Mar 04 08:41:34 AST 2015</font></i></div><div><i><font color="#0000ff">;; MSG SIZE rcvd: 113</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><font color="#000000">But when i try to trust add AD, i am getting error</font></div><div><i><font color="#0000ff"><br></font></i></div><div><div style="color:rgb(0,0,255);font-style:italic">[root@kwtpocpbis01 ~]# ipa trust-add --type=ad <a href="http://kwttestdc.com">kwttestdc.com</a> --admin adm-ben.george --password</div><div style="color:rgb(0,0,255);font-style:italic">Active Directory domain administrator's password:</div><div style="color:rgb(0,0,255);font-style:italic">ipa: ERROR: AD DC was unable to reach any IPA domain controller. Most likely it is a DNS or firewall issue</div><div style="color:rgb(0,0,255);font-style:italic"><br></div><div><font color="#000000">I checked from firewall status on both IPA and AD, and it was in off state. </font></div></div><div><font color="#000000"><br></font></div><div><font color="#000000">below is the error i got on httpd/error_log while trying AD trust</font></div><div><font color="#000000"><br></font></div><div><i><font color="#0000ff">[Wed Mar 04 08:50:30.784320 2015] [:error] [pid 6138] ipa: INFO: [jsonserver_session] admin@SOLIPA.LOCAL: trust_add(u'<a href="http://kwttestdc.com">kwttestdc.com</a>', trust_type=u'ad', realm_admin=u'adm-ben.george', realm_passwd=u'********', all=False, raw=False, version=u'2.113'): RemoteRetrieveError</font></i><br></div><div><i><font color="#0000ff"><br></font></i></div><div><font color="#000000">and i have enable debugging on SM, here attaching logs from samba</font></div><div><font color="#000000"><br></font></div><div><font color="#000000">LOGS can be downloaded from here also : <a href="https://app.box.com/s/6bx9cgozjyb8h96wx7j6ovvz9w8cp4yl">https://app.box.com/s/6bx9cgozjyb8h96wx7j6ovvz9w8cp4yl</a></font></div><div><br></div><div>how can i fix this issue?</div><div><br></div><div>Thanks & Regards,</div><div>Ben</div><div><br></div></div></div>