<div dir="ltr">another thing i notice is:<div><br></div><div><div>[root@kwtpocpbis01 ~]# kinit admin</div><div>Password for admin@SOLARIS.LOCAL:</div><div>[root@kwtpocpbis01 ~]# ipa trust-fetch-domains <a href="http://infra.com">infra.com</a></div><div>ipa: DEBUG: importing all plugin modules in '/usr/lib/python2.7/site-packages/ipalib/plugins'...</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/aci.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/automember.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/automount.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/baseldap.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/batch.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/cert.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/config.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/delegation.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/dns.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/group.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/hbacrule.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/hbacsvc.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/hbacsvcgroup.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/hbactest.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/host.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/hostgroup.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/idrange.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/idviews.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/internal.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/kerberos.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/krbtpolicy.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/migration.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/misc.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/netgroup.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/otpconfig.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/otptoken.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/otptoken_yubikey.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/passwd.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/permission.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/ping.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/pkinit.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/privilege.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/pwpolicy.py'</div><div>ipa: DEBUG: Starting external process</div><div>ipa: DEBUG: args='klist' '-V'</div><div>ipa: DEBUG: Process finished, return code=0</div><div>ipa: DEBUG: stdout=Kerberos 5 version 1.12.2</div><div><br></div><div>ipa: DEBUG: stderr=</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/radiusproxy.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/realmdomains.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/role.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/rpcclient.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/selfservice.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/selinuxusermap.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/service.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/sudocmd.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/sudocmdgroup.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/sudorule.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/trust.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/user.py'</div><div>ipa: DEBUG: importing plugin module '/usr/lib/python2.7/site-packages/ipalib/plugins/virtual.py'</div><div>ipa: DEBUG: Starting external process</div><div>ipa: DEBUG: args='keyctl' 'search' '@s' 'user' 'ipa_session_cookie:admin@SOLARIS.LOCAL'</div><div>ipa: DEBUG: Process finished, return code=0</div><div>ipa: DEBUG: stdout=35095713</div><div><br></div><div>ipa: DEBUG: stderr=</div><div>ipa: DEBUG: Starting external process</div><div>ipa: DEBUG: args='keyctl' 'pipe' '35095713'</div><div>ipa: DEBUG: Process finished, return code=0</div><div>ipa: DEBUG: stdout=ipa_session=cf8484a2b0ee0f8f3fe2cac8c6ad7570; Domain=kwtpocpbis01.solaris.local; Path=/ipa; Expires=Tue, 17 Mar 2015 10:23:58 GMT; Secure; HttpOnly</div><div>ipa: DEBUG: stderr=</div><div>ipa: DEBUG: found session_cookie in persistent storage for principal 'admin@SOLARIS.LOCAL', cookie: 'ipa_session=cf8484a2b0ee0f8f3fe2cac8c6ad7570; Domain=kwtpocpbis01.solaris.local; Path=/ipa; Expires=Tue, 17 Mar 2015 10:23:58 GMT; Secure; HttpOnly'</div><div>ipa: DEBUG: setting session_cookie into context 'ipa_session=cf8484a2b0ee0f8f3fe2cac8c6ad7570;'</div><div>ipa: INFO: trying <a href="https://kwtpocpbis01.solaris.local/ipa/session/json">https://kwtpocpbis01.solaris.local/ipa/session/json</a></div><div>ipa: DEBUG: Created connection context.rpcclient</div><div>ipa: DEBUG: raw: trust_fetch_domains(u'<a href="http://infra.com">infra.com</a>', rights=False, all=False, raw=False, version=u'2.113')</div><div>ipa: DEBUG: trust_fetch_domains(u'<a href="http://infra.com">infra.com</a>', rights=False, all=False, raw=False, version=u'2.113')</div><div>ipa: INFO: Forwarding 'trust_fetch_domains' to json server '<a href="https://kwtpocpbis01.solaris.local/ipa/session/json">https://kwtpocpbis01.solaris.local/ipa/session/json</a>'</div><div>ipa: DEBUG: NSSConnection init kwtpocpbis01.solaris.local</div><div>ipa: DEBUG: Connecting: <a href="http://172.16.107.244:0">172.16.107.244:0</a></div><div>ipa: DEBUG: auth_certificate_callback: check_sig=True is_server=False</div><div>Data:</div><div> Version: 3 (0x2)</div><div> Serial Number: 9 (0x9)</div><div> Signature Algorithm:</div><div> Algorithm: PKCS #1 SHA-256 With RSA Encryption</div><div> Issuer: CN=Certificate Authority,O=SOLARIS.LOCAL</div><div> Validity:</div><div> Not Before: Wed Mar 04 16:08:30 2015 UTC</div><div> Not After: Sat Mar 04 16:08:30 2017 UTC</div><div> Subject: CN=kwtpocpbis01.solaris.local,O=SOLARIS.LOCAL</div><div> Subject Public Key Info:</div><div> Public Key Algorithm:</div><div> Algorithm: PKCS #1 RSA Encryption</div><div> RSA Public Key:</div><div> Modulus:</div><div> b7:bd:18:57:5f:27:23:87:78:32:51:25:25:2f:32:eb:</div><div> b7:d7:7e:3d:91:e0:58:26:24:92:3c:c7:f3:f9:88:b6:</div><div> e6:d1:61:b7:d3:f7:30:61:4e:d7:59:70:bd:62:86:a3:</div><div> 51:ae:8e:ed:bc:7e:df:4d:5f:40:89:82:50:ad:a7:76:</div><div> 8a:2c:83:a7:51:41:8d:d9:0f:06:6e:f9:a8:f3:7c:38:</div><div> bc:af:28:14:cb:d1:ee:49:75:a0:07:c0:45:44:81:b1:</div><div> 48:3d:ab:be:69:12:d2:e1:07:c7:e8:62:32:ac:88:19:</div><div> 22:c5:4c:04:f8:b8:c1:57:71:c2:fc:13:fd:51:67:6d:</div><div> 2a:6a:1e:f6:4a:28:95:b2:90:83:9f:f9:ca:f8:0e:10:</div><div> aa:49:a4:00:76:1a:22:16:25:91:f2:d1:c7:f4:23:a5:</div><div> da:40:f6:e4:5a:b3:17:56:aa:e3:3c:74:d5:30:85:1c:</div><div> 54:99:0d:dc:1e:62:46:cf:a9:dc:96:82:06:08:8d:92:</div><div> 56:5d:02:fe:de:00:f2:5f:c7:07:e3:ee:1c:51:32:73:</div><div> f4:5c:94:c1:6d:04:ae:6d:2c:f4:4d:21:c2:da:42:db:</div><div> 76:fe:f0:01:6d:69:94:25:20:68:54:20:16:be:11:51:</div><div> 00:3b:2f:d8:e8:5a:6b:b8:91:ec:41:e1:8f:f6:14:eb</div><div> Exponent:</div><div> 65537 (0x10001)</div><div> Signed Extensions: (6 total)</div><div> Name: Certificate Authority Key Identifier</div><div> Critical: False</div><div> Key ID:</div><div> 52:ae:39:5b:0b:ea:85:4d:5e:11:08:7e:55:49:c9:1c:</div><div> 04:e8:76:ea</div><div> Serial Number: None</div><div> General Names: [0 total]</div><div><br></div><div> Name: Authority Information Access</div><div> Critical: False</div><div> Authority Information Access: [1 total]</div><div> Info [1]:</div><div> Method: PKIX Online Certificate Status Protocol</div><div> Location: URI: <a href="http://ipa-ca.solaris.local/ca/ocsp">http://ipa-ca.solaris.local/ca/ocsp</a></div><div><br></div><div> Name: Certificate Key Usage</div><div> Critical: True</div><div> Usages:</div><div> Digital Signature</div><div> Non-Repudiation</div><div> Key Encipherment</div><div> Data Encipherment</div><div><br></div><div> Name: Extended Key Usage</div><div> Critical: False</div><div> Usages:</div><div> TLS Web Server Authentication Certificate</div><div> TLS Web Client Authentication Certificate</div><div><br></div><div> Name: CRL Distribution Points</div><div> Critical: False</div><div> CRL Distribution Points: [1 total]</div><div> Point [1]:</div><div> General Names: [1 total]</div><div> <a href="http://ipa-ca.solaris.local/ipa/crl/MasterCRL.bin">http://ipa-ca.solaris.local/ipa/crl/MasterCRL.bin</a></div><div> Issuer: Directory Name: CN=Certificate Authority,O=ipaca</div><div> Reasons: ()</div><div><br></div><div> Name: Certificate Subject Key ID</div><div> Critical: False</div><div> Data:</div><div> 29:0f:9e:4d:a1:62:bf:ae:67:ca:82:f1:c2:6b:18:20:</div><div> fb:40:db:c9</div><div><br></div><div> Signature:</div><div> Signature Algorithm:</div><div> Algorithm: PKCS #1 SHA-256 With RSA Encryption</div><div> Signature:</div><div> b7:76:76:ab:bf:ca:b0:4a:a3:7b:db:a8:fd:b3:15:4f:</div><div> b6:6a:28:b5:e9:1b:55:2d:e2:f6:dc:f1:16:ee:4d:8e:</div><div> b6:5b:5c:fc:0d:32:5f:07:69:92:92:01:45:f5:c5:e0:</div><div> 15:b7:30:62:d2:46:c0:d7:2f:74:e8:9a:5c:99:ba:01:</div><div> dc:a2:fb:02:f8:3f:31:9f:15:51:87:c0:38:c2:86:5b:</div><div> 1e:dc:ab:10:a2:93:6b:88:b2:31:35:9d:ac:09:38:1b:</div><div> d8:ad:19:67:96:e4:55:8e:f6:9e:e3:99:be:cd:28:16:</div><div> 69:16:3d:57:b4:23:43:79:f4:22:6d:a7:07:55:59:6e:</div><div> a0:b7:23:99:7c:4d:28:55:fb:88:88:e8:24:f0:67:af:</div><div> 4a:f5:b8:60:b6:d1:5d:42:10:6f:9f:83:c0:9c:db:d2:</div><div> 12:4d:ac:18:d0:17:c1:e3:77:83:c7:14:13:1f:73:d0:</div><div> f3:ee:25:bb:72:cb:6d:bb:da:4b:ca:fc:25:ea:09:0a:</div><div> 09:5f:6e:51:3d:e2:5e:63:9c:0f:d5:4f:cb:d8:88:be:</div><div> 4c:e6:b2:05:74:ed:2e:25:72:c4:0a:c7:84:47:97:28:</div><div> 79:a5:a0:1d:6d:b4:86:55:e7:61:3f:df:db:1c:cc:37:</div><div> 24:a7:3e:40:35:12:f9:45:08:d6:3f:ca:74:34:51:ee</div><div> Fingerprint (MD5):</div><div> 73:b9:df:20:b1:f5:b7:29:55:de:88:88:9f:8b:ab:e7</div><div> Fingerprint (SHA1):</div><div> 91:83:4b:fa:2f:c0:dc:3e:cc:e4:35:bf:69:f3:db:6c:</div><div> 7f:ca:1b:21</div><div>ipa: DEBUG: approved_usage = SSL Server intended_usage = SSL Server</div><div>ipa: DEBUG: cert valid True for "CN=kwtpocpbis01.solaris.local,O=SOLARIS.LOCAL"</div><div>ipa: DEBUG: handshake complete, peer = <a href="http://172.16.107.244:443">172.16.107.244:443</a></div><div>ipa: DEBUG: received Set-Cookie 'ipa_session=cf8484a2b0ee0f8f3fe2cac8c6ad7570; Domain=kwtpocpbis01.solaris.local; Path=/ipa; Expires=Tue, 17 Mar 2015 10:24:32 GMT; Secure; HttpOnly'</div><div>ipa: DEBUG: storing cookie 'ipa_session=cf8484a2b0ee0f8f3fe2cac8c6ad7570; Domain=kwtpocpbis01.solaris.local; Path=/ipa; Expires=Tue, 17 Mar 2015 10:24:32 GMT; Secure; HttpOnly' for principal admin@SOLARIS.LOCAL</div><div>ipa: DEBUG: Starting external process</div><div>ipa: DEBUG: args='keyctl' 'search' '@s' 'user' 'ipa_session_cookie:admin@SOLARIS.LOCAL'</div><div>ipa: DEBUG: Process finished, return code=0</div><div>ipa: DEBUG: stdout=35095713</div><div><br></div><div>ipa: DEBUG: stderr=</div><div>ipa: DEBUG: Starting external process</div><div>ipa: DEBUG: args='keyctl' 'search' '@s' 'user' 'ipa_session_cookie:admin@SOLARIS.LOCAL'</div><div>ipa: DEBUG: Process finished, return code=0</div><div>ipa: DEBUG: stdout=35095713</div><div><br></div><div>ipa: DEBUG: stderr=</div><div>ipa: DEBUG: Starting external process</div><div>ipa: DEBUG: args='keyctl' 'pupdate' '35095713'</div><div>ipa: DEBUG: Process finished, return code=0</div><div>ipa: DEBUG: stdout=</div><div>ipa: DEBUG: stderr=</div><div>ipa: DEBUG: Destroyed connection context.rpcclient</div><div>ipa: ERROR: Insufficient access: CIFS server denied your credentials</div></div><div><br></div><div><br></div><div><br></div><div>and it accepting password for admin and i can able to see tickets:</div><div><br></div><div><div>[root@kwtpocpbis01 ~]# klist</div><div>Ticket cache: KEYRING:persistent:0:0</div><div>Default principal: admin@SOLARIS.LOCAL</div><div><br></div><div>Valid starting Expires Service principal</div><div>03/17/2015 13:04:29 03/18/2015 13:04:26 krbtgt/SOLARIS.LOCAL@SOLARIS.LOCAL</div></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Mar 17, 2015 at 12:57 PM, Ben .T.George <span dir="ltr"><<a href="mailto:bentech4you@gmail.com" target="_blank">bentech4you@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">HI<div><br></div><div>i have enabled debug</div><div><br></div><div>here is my sssd.conf</div><div><br></div><div><div>[root@kwtpocpbis01 ~]# cat /etc/sssd/sssd.conf</div><div>[domain/solaris.local]</div><div><br></div><div>cache_credentials = True</div><div>krb5_store_password_if_offline = True</div><div>ipa_domain = solaris.local</div><div>id_provider = ipa</div><div>auth_provider = ipa</div><div>access_provider = ipa</div><div>ipa_hostname = kwtpocpbis01.solaris.local</div><div>chpass_provider = ipa</div><div>ipa_server = kwtpocpbis01.solaris.local</div><div>ipa_server_mode = True</div><div>ldap_tls_cacert = /etc/ipa/ca.crt</div><div>[sssd]</div><div>services = nss, sudo, pam, ssh</div><div>config_file_version = 2</div><div><br></div><div>domains = solaris.local</div><div>debug_level = 6</div><div>[nss]</div><div>homedir_substring = /home</div><div>debug_level = 6</div><div><br></div><div>[pam]</div><div><br></div><div>[sudo]</div><div><br></div><div>[autofs]</div><div><br></div><div>[ssh]</div><div><br></div><div>[pac]</div><div><br></div><div>[ifp]</div></div><div><br></div><div><br></div><div>LOGS:</div><div><br></div><div>sssd.log:</div><div><br></div><div><div>(Tue Mar 17 12:45:34 2015) [sssd] [service_send_ping] (0x0100): Pinging solaris.local</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [service_send_ping] (0x0100): Pinging nss</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [service_send_ping] (0x0100): Pinging sudo</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [service_send_ping] (0x0100): Pinging pam</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [service_send_ping] (0x0100): Pinging ssh</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [service_send_ping] (0x0100): Pinging pac</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [ping_check] (0x0100): Service nss replied to ping</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [ping_check] (0x0100): Service sudo replied to ping</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [ping_check] (0x0100): Service pam replied to ping</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [ping_check] (0x0100): Service ssh replied to ping</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [ping_check] (0x0100): Service solaris.local replied to ping</div><div>(Tue Mar 17 12:45:34 2015) [sssd] [ping_check] (0x0100): Service pac replied to ping</div></div><div><br></div><div><br></div><div>error_log:</div><div><br></div><div><div>[root@kwtpocpbis01 ~]# tail -f /var/log/httpd/error_log</div><div>[Tue Mar 17 11:26:25.458878 2015] [:error] [pid 15175] ipa: INFO: *** PROCESS START ***</div><div>[Tue Mar 17 11:26:25.603536 2015] [:error] [pid 15176] ipa: DEBUG: session_auth_duration: 0:20:00</div><div>[Tue Mar 17 11:26:25.609112 2015] [:error] [pid 15176] ipa: DEBUG: session_auth_duration: 0:20:00</div><div>[Tue Mar 17 11:26:25.655477 2015] [:error] [pid 15176] ipa: DEBUG: Mounting ipaserver.rpcserver.login_kerberos() at '/session/login_kerberos'</div><div>[Tue Mar 17 11:26:25.655597 2015] [:error] [pid 15176] ipa: DEBUG: session_auth_duration: 0:20:00</div><div>[Tue Mar 17 11:26:25.681652 2015] [:error] [pid 15176] ipa: DEBUG: Mounting ipaserver.rpcserver.login_password() at '/session/login_password'</div><div>[Tue Mar 17 11:26:25.681849 2015] [:error] [pid 15176] ipa: DEBUG: session_auth_duration: 0:20:00</div><div>[Tue Mar 17 11:26:25.754351 2015] [:error] [pid 15176] ipa: INFO: *** PROCESS START ***</div><div>p11-kit: ipa.p11-kit: x-public-key-info: invalid or unsupported attribute</div><div>[Tue Mar 17 11:26:28.847563 2015] [:warn] [pid 15377] NSSProtocol: Unknown protocol 'tlsv1.2' not supported</div></div><div><br></div><div>secure:</div><div><div>[root@kwtpocpbis01 log]# tail -f secure</div><div>Mar 17 12:35:41 kwtpocpbis01 sshd[15714]: subsystem request for sftp by user root</div><div>Mar 17 12:35:44 kwtpocpbis01 sshd[15736]: Accepted password for root from 10.18.2.130 port 64141 ssh2</div><div>Mar 17 12:35:44 kwtpocpbis01 sshd[15736]: pam_unix(sshd:session): session opened for user root by (uid=0)</div><div>Mar 17 12:35:44 kwtpocpbis01 sshd[15736]: subsystem request for sftp by user root</div><div>Mar 17 12:39:12 kwtpocpbis01 sshd[14507]: pam_unix(sshd:session): session closed for user root</div><div>Mar 17 12:40:57 kwtpocpbis01 sshd[15816]: Invalid user <a href="mailto:bobby@infra.com" target="_blank">bobby@infra.com</a> from 10.18.2.130</div><div>Mar 17 12:40:57 kwtpocpbis01 sshd[15816]: input_userauth_request: invalid user <a href="mailto:bobby@infra.com" target="_blank">bobby@infra.com</a> [preauth]</div><div>Mar 17 12:41:02 kwtpocpbis01 sshd[15816]: pam_unix(sshd:auth): check pass; user unknown</div><div>Mar 17 12:41:02 kwtpocpbis01 sshd[15816]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.18.2.130</div><div>Mar 17 12:41:04 kwtpocpbis01 sshd[15816]: Failed password for invalid user <a href="mailto:bobby@infra.com" target="_blank">bobby@infra.com</a> from 10.18.2.130 port 64470 ssh2</div><div><br></div><div>Mar 17 12:44:56 kwtpocpbis01 sshd[15840]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.18.2.130 user=<a href="mailto:ben@infra.com" target="_blank">ben@infra.com</a></div><div>Mar 17 12:44:57 kwtpocpbis01 sshd[15840]: pam_sss(sshd:auth): authentication success; logname= uid=0 euid=0 tty=ssh ruser= rhost=10.18.2.130 user=<a href="mailto:ben@infra.com" target="_blank">ben@infra.com</a></div><div>Mar 17 12:44:57 kwtpocpbis01 sshd[15840]: Accepted password for <a href="mailto:ben@infra.com" target="_blank">ben@infra.com</a> from 10.18.2.130 port 64782 ssh2</div><div>Mar 17 12:44:59 kwtpocpbis01 sshd[15840]: pam_unix(sshd:session): session opened for user <a href="mailto:ben@infra.com" target="_blank">ben@infra.com</a> by (uid=0)</div></div><div><br></div><div><br></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Mar 17, 2015 at 12:09 PM, Jakub Hrozek <span dir="ltr"><<a href="mailto:jhrozek@redhat.com" target="_blank">jhrozek@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On Tue, Mar 17, 2015 at 11:37:24AM +0300, Ben .T.George wrote:<br>
> HI List<br>
><br>
> i was following this link :<br>
> <a href="http://www.freeipa.org/page/Active_Directory_trust_setup#Assumptions" target="_blank">http://www.freeipa.org/page/Active_Directory_trust_setup#Assumptions</a><br>
> to setup IPA server<br>
><br>
> my IPA version is 4.1.2<br>
><br>
> every setps in this tutorials was passed without any error<br>
><br>
</span>> even "*Allow access for users from AD domain to protected resources*"<br>
<span>> went successfully<br>
> my current issue is only one user called ben can able to login to ipa<br>
> server.please check below:<br>
><br>
> [root@kwtpocpbis01 ~]# getent passwd <a href="mailto:ben@infra.com" target="_blank">ben@infra.com</a><br>
> ben@infra.com:*:531001104:531001104:ben:/home/<a href="http://infra.com/ben" target="_blank">infra.com/ben</a>:<br>
> [root@kwtpocpbis01 ~]# getent passwd <a href="mailto:bobby@infra.com" target="_blank">bobby@infra.com</a><br>
> [root@kwtpocpbis01 ~]# getent passwd <a href="mailto:administrator@infra.com" target="_blank">administrator@infra.com</a><br>
> [root@kwtpocpbis01 ~]#<br>
><br>
> the users ben & bobby are on same group (Domain users). but bobby cannot<br>
> able to login to IPA and not getting any information while querying<br>
> please help me to fix this issue. i don't know where i need to troubleshoot<br>
> this issue.<br>
<br>
</span>Can you increase debug_level in both [nss] and [domain] sections on the<br>
server and paste the logs here?<br>
<span><font color="#888888"><br>
--<br>
Manage your subscription for the Freeipa-users mailing list:<br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project<br>
</font></span></blockquote></div><br></div>
</div></div></blockquote></div><br></div>