<div dir="ltr">Hi Alexander,<div><br></div><div>can you please give me clue what will be error message</div><div><br></div><div>"member group: KWTTESTDC\Domain Admins: invalid 'trusted domain object': no trusted domain matched the specified flat name"</div><div><br></div><div>Regards,</div><div>Ben</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Mar 5, 2015 at 9:35 AM, Ben .T.George <span dir="ltr"><<a href="mailto:bentech4you@gmail.com" target="_blank">bentech4you@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">HI<div><br></div><div>sorry ntp was stopped. now time is in sync. rebooted machine</div><div><br></div><div>buy process is not going through</div><div><br></div><div><div><i><font color="#0000ff">[root@kwtpocpbis01 ~]# ipa group-add-member ad_admins_external --external 'ad_netbios\Domain Admins'</font></i></div><div><i><font color="#0000ff">[member user]:</font></i></div><div><i><font color="#0000ff">[member group]:</font></i></div><div><i><font color="#0000ff"> Group name: ad_admins_external</font></i></div><div><i><font color="#0000ff"> Description: <a href="http://infra.com" target="_blank">infra.com</a> admins external map</font></i></div><div><i><font color="#0000ff"> Failed members:</font></i></div><div><i><font color="#0000ff"> member user:</font></i></div><div><i><font color="#0000ff"> member group: ad_netbios\Domain Admins: invalid 'trusted domain object': no trusted domain matched the specified flat name</font></i></div><span class=""><div><i><font color="#0000ff">-------------------------</font></i></div><div><i><font color="#0000ff">Number of members added 0</font></i></div><div><i><font color="#0000ff"><br></font></i></div><div><i><font color="#0000ff">-------------------------</font></i></div></span><div><i><font color="#0000ff">[root@kwtpocpbis01 ~]# ipa group-add-member ad_admins_external --external 'ad_netbios\Domain Users'</font></i></div><div><i><font color="#0000ff">[member user]:</font></i></div><div><i><font color="#0000ff">[member group]:</font></i></div><div><i><font color="#0000ff"> Group name: ad_admins_external</font></i></div><div><i><font color="#0000ff"> Description: <a href="http://infra.com" target="_blank">infra.com</a> admins external map</font></i></div><div><i><font color="#0000ff"> Failed members:</font></i></div><div><i><font color="#0000ff"> member user:</font></i></div><div><i><font color="#0000ff"> member group: ad_netbios\Domain Users: invalid 'trusted domain object': no trusted domain matched the specified flat name</font></i></div><span class=""><div><i><font color="#0000ff">-------------------------</font></i></div><div><i><font color="#0000ff">Number of members added 0</font></i></div><div><i><font color="#0000ff">-------------------------</font></i></div></span></div><div><br></div><div>And the error message on error_log is :</div><div><br></div><div><div>[Thu Mar 05 09:31:50.146154 2015] [:error] [pid 2101] ipa: INFO: [jsonserver_kerb] admin@SOLARIS.LOCAL: group_add_member(u'ad_admins_external', ipaexternalmember=(u'ad_netbios\\\\Domain Admins',), all=False, raw=False, version=u'2.113', no_members=False): SUCCESS</div><div><br></div><div>[Thu Mar 05 09:32:15.761885 2015] [:error] [pid 2101] ipa: INFO: [jsonserver_kerb] admin@SOLARIS.LOCAL: group_add_member(u'ad_admins_external', ipaexternalmember=(u'ad_netbios\\\\Domain Users',), all=False, raw=False, version=u'2.113', no_members=False): SUCCESS</div></div><div><br></div><div><br></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Mar 5, 2015 at 8:52 AM, Alexander Bokovoy <span dir="ltr"><<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On Thu, 05 Mar 2015, Ben .T.George wrote:<br>
</span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>
Hi<br>
<br>
i have re-installed everything . my current versions are Centos 7 with IPA<br>
4.1<br>
<br>
i followed this tutorial:<br>
<a href="http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup" target="_blank">http://www.freeipa.org/page/<u></u>Howto/IPAv3_AD_trust_setup</a><br>
<br>
when i fetch , it went successful:<br>
<br></span>
*[root@kwtpocpbis01 ~]# ipa trustdomain-find "<a href="http://infra.com" target="_blank">infra.com</a> <<a href="http://infra.com" target="_blank">http://infra.com</a>>"*<br>
* Domain name: <a href="http://infra.com" target="_blank">infra.com</a> <<a href="http://infra.com" target="_blank">http://infra.com</a>>*<br>
* Domain NetBIOS name: INFRA*<br>
* Domain Security Identifier: S-1-5-21-191287045-4012216658-<u></u>3592112898*<br>
* Domain enabled: True*<br>
*----------------------------*<br>
*Number of entries returned 1*<br>
*----------------------------*<br>
*[root@kwtpocpbis01 ~]# ipa trustdomain-find "<a href="http://infra.com" target="_blank">infra.com</a> <<a href="http://infra.com" target="_blank">http://infra.com</a>>"*<br>
* Domain name: <a href="http://infra.com" target="_blank">infra.com</a> <<a href="http://infra.com" target="_blank">http://infra.com</a>>*<br>
* Domain NetBIOS name: INFRA*<br>
* Domain Security Identifier: S-1-5-21-191287045-4012216658-<u></u>3592112898*<br>
* Domain enabled: True*<br>
*----------------------------*<br>
*Number of entries returned 1*<br>
*----------------------------*<span><br>
<br>
when i gone through "Allow access for users from AD domain to protected<br>
resources", i am getting errors,<br>
<br>
<br></span>
*[root@kwtpocpbis01 ~]# ipa group-add --desc='<a href="http://infra.com" target="_blank">infra.com</a> <<a href="http://infra.com" target="_blank">http://infra.com</a>><br>
users external map' ad_users_external --external*<br>
*-----------------------------<u></u>--*<br>
*Added group "ad_users_external"*<br>
*-----------------------------<u></u>--*<br>
* Group name: ad_users_external*<br>
* Description: <a href="http://infra.com" target="_blank">infra.com</a> <<a href="http://infra.com" target="_blank">http://infra.com</a>> users external map*<br>
<br>
*[root@kwtpocpbis01 ~]# ipa group-add --desc='<a href="http://infra.com" target="_blank">infra.com</a> <<a href="http://infra.com" target="_blank">http://infra.com</a>><br>
users' ad_users*<br>
*----------------------*<br>
*Added group "ad_users"*<br>
*----------------------*<br>
* Group name: ad_users*<br>
* Description: <a href="http://infra.com" target="_blank">infra.com</a> <<a href="http://infra.com" target="_blank">http://infra.com</a>> users*<br>
* GID: 643400005*<br>
<br>
*[root@kwtpocpbis01 ~]# ipa group-add-member ad_users_external --external<br>
'INFRA\Domain Users'*<br>
*[member user]:*<br>
*[member group]:*<br>
* Group name: ad_users_external*<br>
* Description: <a href="http://infra.com" target="_blank">infra.com</a> <<a href="http://infra.com" target="_blank">http://infra.com</a>> users external map*<br>
* Failed members:*<br>
* member user:*<br>
* member group: INFRA\Domain Users: trusted domain object not found*<br>
*-------------------------*<br>
*Number of members added 0*<br>
*-------------------------*<br>
<br>
*[root@kwtpocpbis01 ~]# ipa group-add-member ad_users --groups<br>
ad_users_external*<br>
* Group name: ad_users*<br>
* Description: <a href="http://infra.com" target="_blank">infra.com</a> <<a href="http://infra.com" target="_blank">http://infra.com</a>> users*<br>
* GID: 643400005*<br>
* Member groups: ad_users_external*<br>
*-------------------------*<br>
*Number of members added 1*<br>
*-------------------------*<span><br>
<br>
please help me to solve this issue:<br>
<br></span>
below error is getting on httpd/error_log while trying : *ipa<br>
group-add-member ad_users_external --external 'INFRA\Domain Users'*<br>
<br>
*[Thu Mar 05 11:36:37.371594 2015] [:error] [pid 4090] ipa: WARNING: Search<br>
on AD DC <a href="http://kwtipaad001.infra.com:3268" target="_blank">kwtipaad001.infra.com:3268</a> <<a href="http://kwtipaad001.infra.com:3268" target="_blank">http://kwtipaad001.infra.com:<u></u>3268</a>><span><br>
failed with: Insufficient access: SASL(-1): generic failure: GSSAPI Error:<br>
Unspecified GSS failure. Minor code may provide more information (Ticket<br></span>
not yet valid)*<br>
*[Thu Mar 05 11:36:37.<a href="tel:374280%202015" value="+913742802015" target="_blank">374280 2015</a>] [:error] [pid 4090] ipa: INFO:<span><br>
[jsonserver_kerb] admin@SOLARIS.LOCAL:<br>
group_add_member(u'ad_users_<u></u>external', ipaexternalmember=(u'INFRA\\\\<u></u>Domain<br>
Users',), all=False, raw=False, version=u'2.113', no_members=False):<br></span>
SUCCESS*<br>
</blockquote>
OK, "Ticket not yet valid" is time synchronization issue -- AD DC has<br>
time behind IPA DC. Check time and time zone settings.<span><font color="#888888"><br>
<br>
-- <br>
/ Alexander Bokovoy<br>
</font></span></blockquote></div><br></div>
</div></div></blockquote></div><br></div>