<p dir="ltr">/etc/nsswitch.conf:</p>
<p dir="ltr">passwd:     files<br>
shadow:     files<br>
group:      files<br>
hosts:      files mdns4_minimal [NOTFOUND=return] dns myhostname<br>
bootparams: nisplus [NOTFOUND=return] files<br>
ethers:     files<br>
netmasks:   files<br>
networks:   files<br>
protocols:  files<br>
rpc:        files<br>
services:   files<br>
netgroup:   files<br>
publickey:  nisplus<br>
automount:  files<br>
aliases:    files nisplus<br>
sudoers: files sss</p>
<div class="gmail_quote">On 21 Mar 2015 01:06, "Dmitri Pal" <<a href="mailto:dpal@redhat.com">dpal@redhat.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
  
    
  
  <div bgcolor="#FFFFFF" text="#000000">
    <div>On 03/20/2015 07:56 PM, Roberto
      Cornacchia wrote:<br>
    </div>
    <blockquote type="cite">
      <div dir="ltr">From <a href="https://fedorahosted.org/sssd/wiki/Troubleshooting" target="_blank">https://fedorahosted.org/sssd/wiki/Troubleshooting</a>,
        I see that invoking getent should correspond to seeing command
        17 invoked in the nss log:
        <div><br>
        </div>
        <div>Something like:</div>
        <div><font face="monospace, monospace">[sssd[nss]]
            [nss_cmd_getbynam] (0x0400): Running command [17] with input
            [admin].</font><br>
        </div>
        <div><font face="monospace, monospace"><br>
          </font></div>
        <div><font face="arial, helvetica, sans-serif">I don't see any
            command invocation in my </font><span style="font-family:arial,helvetica,sans-serif">sss_d</span><span style="font-family:arial,helvetica,sans-serif">nss log</span></div>
      </div>
      <div class="gmail_extra"><br>
      </div>
    </blockquote>
    <br>
    Forgot to reply to the list...<br>
    <br>
    Right.<br>
    So how does your nsswitch.conf looks like?<br>
    <br>
    <br>
    <blockquote type="cite">
      <div class="gmail_extra">
        <div class="gmail_quote">On 21 March 2015 at 00:51, Roberto
          Cornacchia <span dir="ltr"><<a href="mailto:roberto.cornacchia@gmail.com" target="_blank">roberto.cornacchia@gmail.com</a>></span>
          wrote:<br>
          <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
            <div dir="ltr">Ah, I see, I had forgotten to enable debut in
              the nss section. Here its log.</div>
            <div>
              <div>
                <div class="gmail_extra"><br>
                  <div class="gmail_quote">On 21 March 2015 at 00:40,
                    Roberto Cornacchia <span dir="ltr"><<a href="mailto:roberto.cornacchia@gmail.com" target="_blank">roberto.cornacchia@gmail.com</a>></span>
                    wrote:<br>
                    <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
                      <div dir="ltr">Two log files in attachment (the
                        other files in /var/log/sssd are all empty). 
                        <div><br>
                        </div>
                        <div>I'll also go through the troubleshooting
                          page again, thanks
                          <div><br>
                          </div>
                        </div>
                      </div>
                      <div>
                        <div>
                          <div class="gmail_extra"><br>
                            <div class="gmail_quote">On 20 March 2015 at
                              23:03, Dmitri Pal <span dir="ltr"><<a href="mailto:dpal@redhat.com" target="_blank">dpal@redhat.com</a>></span>
                              wrote:<br>
                              <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
                                <div bgcolor="#FFFFFF" text="#000000"><span>
                                    <div>On 03/20/2015 05:59 PM, Roberto
                                      Cornacchia wrote:<br>
                                    </div>
                                    <blockquote type="cite">
                                      <div dir="ltr">SSSD logs are empty
                                        so far.</div>
                                    </blockquote>
                                    <br>
                                  </span> This is wrong.<span><br>
                                    <br>
                                    <blockquote type="cite">
                                      <div dir="ltr">
                                        <div>Isn't sssd.conf written by
                                          ipa-client-install? </div>
                                      </div>
                                    </blockquote>
                                    <br>
                                  </span> Yes<span><br>
                                    <br>
                                    <blockquote type="cite">
                                      <div dir="ltr">
                                        <div>If I raise the debug level
                                          after client installation,</div>
                                      </div>
                                    </blockquote>
                                    <br>
                                  </span> (and restart)<span><br>
                                    <br>
                                    <blockquote type="cite">
                                      <div dir="ltr">
                                        <div> what activities do you
                                          suggest to attempt from the
                                          client?<br>
                                        </div>
                                      </div>
                                    </blockquote>
                                  </span> the ones that fail. getent
                                  call that returns nothing.<br>
                                  Also try 'id'.<br>
                                  <br>
                                  <a href="http://www.freeipa.org/page/Troubleshooting#Client_Installation" target="_blank">http://www.freeipa.org/page/Troubleshooting#Client_Installation</a><br>
                                  <a href="https://fedorahosted.org/sssd/wiki/Troubleshooting" target="_blank">https://fedorahosted.org/sssd/wiki/Troubleshooting</a>
                                  <div>
                                    <div><br>
                                      <blockquote type="cite">
                                        <div dir="ltr">
                                          <div>
                                            <div><br>
                                              <div class="gmail_extra"><br>
                                                <div class="gmail_quote">On
                                                  20 March 2015 at
                                                  22:37, Dmitri Pal <span dir="ltr"><<a href="mailto:dpal@redhat.com" target="_blank">dpal@redhat.com</a>></span>
                                                  wrote:<br>
                                                  <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
                                                    <div bgcolor="#FFFFFF" text="#000000"><span>
                                                        <div>On
                                                          03/20/2015
                                                          05:28 PM,
                                                          Roberto
                                                          Cornacchia
                                                          wrote:<br>
                                                        </div>
                                                        <blockquote type="cite">
                                                          <div dir="ltr">
                                                          <div>It
                                                          certainly gets
                                                          there, because
                                                          the client
                                                          gets in fact
                                                          enrolled as a
                                                          domain host. I
                                                          can see it
                                                          from the UI in
                                                          Identity /
                                                          Hosts. But not
                                                          in the DNS
                                                          zone.</div>
                                                          <div><br>
                                                          </div>
                                                          <div><b>Before
                                                          ipa-client-install,
                                                          all these do
                                                          work: </b></div>
                                                          <div><br>
                                                          </div>
                                                          <font face="monospace,
                                                          monospace">$
                                                          ssh <a href="http://ipa.hq.example.com" target="_blank">ipa.hq.example.com</a> </font>
                                                          <div><font face="monospace,
                                                          monospace">$
                                                          ntpdate </font><span style="font-family:monospace,monospace"><a href="http://ipa.hq.example.com" target="_blank">ipa.hq.example.com</a></span></div>
                                                          <div><font face="monospace,
                                                          monospace">$
                                                          ldapsearch -x
                                                          -h <a href="http://ipa.hq.example.com" target="_blank">ipa.hq.example.com</a>
                                                          -b
                                                          dc=hq,dc=example,dc=com
                                                          uid=admin</font></div>
                                                          <div class="gmail_extra"><br>
                                                          </div>
                                                          <div class="gmail_extra"><br>
                                                          </div>
                                                          <div class="gmail_extra"><font face="arial,
                                                          helvetica,
                                                          sans-serif"><b>After
                                                          running
                                                          ipa-client-install,
                                                          all these do
                                                          work:</b></font></div>
                                                          <div class="gmail_extra"><font face="arial,
                                                          helvetica,
                                                          sans-serif"><br>
                                                          </font></div>
                                                          <div class="gmail_extra"><font face="monospace,
                                                          monospace">$
                                                          kinit admin</font></div>
                                                          <div class="gmail_extra"><font face="monospace,
                                                          monospace">Password
                                                          for <a href="mailto:admin@HQ.EXAMPLE.COM" target="_blank">admin@HQ.EXAMPLE.COM</a>:<br>
                                                          </font></div>
                                                          <div class="gmail_extra"><span style="font-family:monospace,monospace">$ ipa dnszone-show --all</span><br>
                                                          </div>
                                                          <div class="gmail_extra">
                                                          <div class="gmail_extra"><font face="monospace,
                                                          monospace">[...]</font></div>
                                                          <div class="gmail_extra"><font face="monospace,
                                                          monospace">$
                                                          ntpq -p</font></div>
                                                          <div class="gmail_extra"><font face="monospace,
                                                          monospace">   
                                                           remote      
                                                              refid    
                                                           st t when
                                                          poll reach  
                                                          delay   offset
                                                           jitter</font></div>
                                                          <div class="gmail_extra"><font face="monospace,
                                                          monospace">==============================================================================</font></div>
                                                          <div class="gmail_extra"><font face="monospace,
                                                          monospace">*ipa.hq.example.


                                                          131.155.140.130
                                                           3 u   19   64
                                                             1    0.415
                                                            -0.006  
                                                          0.000</font></div>
                                                          <div class="gmail_extra"><font face="monospace,
                                                          monospace"> LOCAL(0)
                                                                 .LOCL.
                                                                    5 l
                                                             -   64    0
                                                             0.000  
                                                           0.000   0.000</font></div>
                                                          <div style="font-family:arial,helvetica,sans-serif"><br>
                                                          </div>
                                                          <div class="gmail_quote"><b>But
                                                          this does NOT
                                                          work:</b></div>
                                                          <div class="gmail_quote"><font face="monospace,
                                                          monospace">$ getent

                                                          passwd <a href="mailto:admin@hq.example.com" target="_blank">admin@hq.example.com</a></font></div>
                                                          </div>
                                                          </div>
                                                        </blockquote>
                                                        <br>
                                                      </span><font face="monospace,
                                                        monospace">What
                                                        do SSSD logs
                                                        show on the
                                                        client?<br>
                                                        Please rise the
                                                        SSSD debug_level
                                                        and provide SSSD
                                                        logs.<br>
                                                        <br>
                                                      </font><span>
                                                        <blockquote type="cite">
                                                          <div dir="ltr">
                                                          <div class="gmail_extra">
                                                          <div class="gmail_quote"><br>
                                                          </div>
                                                          <div class="gmail_quote">
                                                          <div class="gmail_extra"><b>On
                                                          the server, in
                                                          /var/log/krb5kdc.log,
                                                          I see many of
                                                          these:</b></div>
                                                          <div class="gmail_extra"><br>
                                                          </div>
                                                          <div class="gmail_extra">
                                                          <div class="gmail_extra"><font face="monospace,
                                                          monospace">Mar
                                                          20 21:53:17 <a href="http://ipa.hq.example.com" target="_blank">ipa.hq.example.com</a>
                                                          krb5kdc[9229](info):
                                                          AS_REQ (6
                                                          etypes {18 17
                                                          16 23 25 26})
                                                          <a href="http://192.168.0.207" target="_blank">192.168.0.207</a>:
                                                          NEEDED_PREAUTH:
                                                          <a href="mailto:admin@HQ.EXAMPLE.COM" target="_blank">admin@HQ.EXAMPLE.COM</a>
                                                          for krbtgt/HQ.</font>EXAMPLE<font face="monospace,
                                                          monospace">.<a href="mailto:COM@HQ.EXAMPLE.COM" target="_blank">COM@HQ.EXAMPLE.COM</a>,
                                                          Additional
                                                          pre-authentication
                                                          required</font></div>
                                                          <div class="gmail_extra"><font face="monospace,
                                                          monospace">Mar
                                                          20 21:53:17 <a href="http://ipa.hq.example.com" target="_blank">ipa.hq.example.com</a>
                                                          krb5kdc[9229](info):
                                                          AS_REQ (6
                                                          etypes {18 17
                                                          16 23 25 26})
                                                          <a href="http://192.168.0.207" target="_blank">192.168.0.207</a>: ISSUE:
                                                          authtime
                                                          1426884797,
                                                          etypes {rep=18
                                                          tkt=18
                                                          ses=18}, <a href="mailto:admin@HQ.EXAMPLE.COM" target="_blank">admin@HQ.EXAMPLE.COM</a>
                                                          for krbtgt/<a href="mailto:HQ.EXAMPLE.COM@HQ.EXAMPLE.COM" target="_blank">HQ.EXAMPLE.COM@HQ.EXAMPLE.COM</a></font></div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          </div>
                                                        </blockquote>
                                                        <br>
                                                      </span> This is
                                                      not an error. It
                                                      is a normal user
                                                      authentication.<br>
                                                      OK so it is DNS
                                                      that is not
                                                      working. Is DNS
                                                      server running on
                                                      the server?<br>
                                                      What do Bind logs
                                                      show?
                                                      <div>
                                                        <div><br>
                                                          <br>
                                                          <blockquote type="cite">
                                                          <div dir="ltr">
                                                          <div class="gmail_extra">
                                                          <div class="gmail_quote">
                                                          <div class="gmail_extra">
                                                          <div><br>
                                                          </div>
                                                          </div>
                                                          <div class="gmail_extra"><font face="arial,
                                                          helvetica,
                                                          sans-serif">192.168.0.207

                                                          is the IP of
                                                          the client I'm
                                                          trying to
                                                          install.
                                                          However,
                                                          higher up in
                                                          the log, I
                                                          also see such
                                                          errors for the
                                                          ipa server
                                                          itself.</font></div>
                                                          <div class="gmail_extra"><font face="arial,
                                                          helvetica,
                                                          sans-serif"><br>
                                                          </font></div>
                                                          </div>
                                                          <div class="gmail_quote">On
                                                          20 March 2015
                                                          at 20:24,
                                                          Dmitri Pal <span dir="ltr"><<a href="mailto:dpal@redhat.com" target="_blank">dpal@redhat.com</a>></span>
                                                          wrote:<br>
                                                          <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
                                                          <div bgcolor="#FFFFFF" text="#000000"><span>
                                                          <div>On
                                                          03/20/2015
                                                          02:48 PM,
                                                          Roberto
                                                          Cornacchia
                                                          wrote:<br>
                                                          </div>
                                                          <blockquote type="cite">
                                                          <div dir="ltr">No,
                                                          all real
                                                          machines.
                                                          <div><br>
                                                          </div>
                                                          <div>I'm
                                                          really sorry
                                                          it's taking so
                                                          much of your
                                                          time. </div>
                                                          <div>I had
                                                          tried almost
                                                          everything on
                                                          a VM setting
                                                          first, and
                                                          everything was
                                                          fine. </div>
                                                          <div>Everything
                                                          always works
                                                          fine, until
                                                          you actually
                                                          need it.</div>
                                                          </div>
                                                          </blockquote>
                                                          <br>
                                                          <br>
                                                          </span> We try
                                                          to help as
                                                          much as we
                                                          can.<br>
                                                          Can you do
                                                          LDAP lookups
                                                          as a directory
                                                          manager from
                                                          client host to
                                                          server?<br>
                                                          Can you ssh
                                                          from client to
                                                          server?<br>
                                                          <br>
                                                          When you try
                                                          to install
                                                          client is
                                                          there anything
                                                          in the logs on
                                                          the server?
                                                          Does it even
                                                          get there?
                                                          <div>
                                                          <div><br>
                                                          <br>
                                                          <br>
                                                          <br>
                                                          <blockquote type="cite">
                                                          <div dir="ltr">
                                                          <div><br>
                                                          </div>
                                                          </div>
                                                          <div class="gmail_extra"><br>
                                                          <div class="gmail_quote">On

                                                          20 March 2015
                                                          at 19:41,
                                                          Dmitri Pal <span dir="ltr"><<a href="mailto:dpal@redhat.com" target="_blank">dpal@redhat.com</a>></span>
                                                          wrote:<br>
                                                          <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
                                                          <div bgcolor="#FFFFFF" text="#000000"><span>
                                                          <div>On
                                                          03/20/2015
                                                          01:57 PM,
                                                          Roberto
                                                          Cornacchia
                                                          wrote:<br>
                                                          </div>
                                                          <blockquote type="cite">
                                                          <div dir="ltr">But

                                                          the ipa server
                                                          itself is also
                                                          enrolled as a
                                                          client, just
                                                          after the
                                                          server
                                                          installation,
                                                          right?. And
                                                          that worked
                                                          fine.</div>
                                                          </blockquote>
                                                          <br>
                                                          </span> Are
                                                          these VMs?<br>
                                                          There have
                                                          been a similar
                                                          case when the
                                                          network was
                                                          not set
                                                          properly for
                                                          the virtual
                                                          test
                                                          environment.
                                                          <div>
                                                          <div><br>
                                                          <br>
                                                          <blockquote type="cite">
                                                          <div class="gmail_extra"><br>
                                                          <div class="gmail_quote">On

                                                          20 March 2015
                                                          at 18:55,
                                                          Roberto
                                                          Cornacchia <span dir="ltr"><<a href="mailto:roberto.cornacchia@gmail.com" target="_blank">roberto.cornacchia@gmail.com</a>></span>
                                                          wrote:<br>
                                                          <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
                                                          <div dir="ltr">
                                                          <p dir="ltr">No,

                                                          sorry about
                                                          the confusion,
                                                          i shouldn't
                                                          have posted so
                                                          quickly.</p>
                                                          <p>When I use
                                                          the correct
                                                          domain (<a href="http://hq.example.com" target="_blank">hq.example.com</a>), then I
                                                          really get all
                                                          the same
                                                          errors as
                                                          before, also
                                                          in the new
                                                          client.</p>
                                                          <p><br>
                                                          </p>
                                                          <p dir="ltr"><br>
                                                          </p>
                                                          <div class="gmail_quote">
                                                          <div>
                                                          <div>On 20 Mar
                                                          2015 18:39,
                                                          "Dmitri Pal"
                                                          <<a href="mailto:dpal@redhat.com" target="_blank">dpal@redhat.com</a>>
                                                          wrote:<br type="attribution">
                                                          </div>
                                                          </div>
                                                          <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
                                                          <div>
                                                          <div>
                                                          <div bgcolor="#FFFFFF" text="#000000">
                                                          <div>On
                                                          03/20/2015
                                                          01:25 PM,
                                                          Roberto
                                                          Cornacchia
                                                          wrote:<br>
                                                          </div>
                                                          <blockquote type="cite">
                                                          <div dir="ltr">Oops.


                                                          Not true,
                                                          forget last
                                                          email.
                                                          <div><br>
                                                          </div>
                                                          <div>This
                                                          secon client
                                                          installation
                                                          went different
                                                          just because
                                                          it took the
                                                          wrong domain.</div>
                                                          <div>It used <b><a href="http://example.com" target="_blank">example.com</a></b> (what




                                                          was previously
                                                          set) instead
                                                          of <b><a href="http://hq.example.com" target="_blank">hq.example.com</a></b></div>
                                                          <div><br>
                                                          </div>
                                                          <div>Uninstalled,


                                                          tried again
                                                          with
                                                          --hostname=<a href="http://photon.hq.example.com" target="_blank">photon.hq.example.com</a></div>
                                                          <div>And then
                                                          it behaves
                                                          precisely like
                                                          the previous
                                                          client.</div>
                                                          <div><br>
                                                          </div>
                                                          <div>So
                                                          something
                                                          seems wrong in
                                                          the server.</div>
                                                          <div>
                                                          <div class="gmail_extra"><br>
                                                          <div class="gmail_quote">On



                                                          20 March 2015
                                                          at 18:18,
                                                          Roberto
                                                          Cornacchia <span dir="ltr"><<a href="mailto:roberto.cornacchia@gmail.com" target="_blank">roberto.cornacchia@gmail.com</a>></span>
                                                          wrote:<br>
                                                          <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
                                                          <div dir="ltr">
                                                          <div>
                                                          <div><font face="arial,
                                                          helvetica,
                                                          sans-serif">Update:</font></div>
                                                          <div><font face="arial,
                                                          helvetica,
                                                          sans-serif">I
                                                          tried from
                                                          another
                                                          client. Also
                                                          FC21, same
                                                          network, same
                                                          settings from
                                                          the same
                                                          DHCP. </font></div>
                                                          <div><font face="arial,
                                                          helvetica,
                                                          sans-serif">But




                                                          obviously it
                                                          must have
                                                          something
                                                          different
                                                          because it
                                                          partially
                                                          succeeded.</font></div>
                                                          <div><font face="arial,
                                                          helvetica,
                                                          sans-serif"><br>
                                                          </font></div>
                                                          <div><font face="arial,
                                                          helvetica,
                                                          sans-serif">-
                                                          I do not get
                                                          errors about
                                                          LDAP users.</font></div>
                                                          <div><font face="arial,
                                                          helvetica,
                                                          sans-serif">-
                                                          I do not get
                                                          errors about
                                                          DNS update</font></div>
                                                          <div><font face="arial,
                                                          helvetica,
                                                          sans-serif"><br>
                                                          </font></div>
                                                          <div><font face="arial,
                                                          helvetica,
                                                          sans-serif">However:</font></div>
                                                          <div><font face="arial,
                                                          helvetica,
                                                          sans-serif">-
                                                          I still get
                                                          the initial
                                                          error about
                                                          NTP</font></div>
                                                          <div><font face="arial,
                                                          helvetica,
                                                          sans-serif">-
                                                          The host is
                                                          enrolled, but
                                                          not added to
                                                          the DNS zone</font></div>
                                                          <div><font face="arial,
                                                          helvetica,
                                                          sans-serif"><br>
                                                          </font></div>
                                                          <div><font face="arial,
                                                          helvetica,
                                                          sans-serif">Now,




                                                          I don't care
                                                          much about the
                                                          previous
                                                          client. It was
                                                          pretty much
                                                          empty and can
                                                          re-install
                                                          Fedora from
                                                          scratch. </font></div>
                                                          <div><font face="arial,
                                                          helvetica,
                                                          sans-serif"><br>
                                                          </font></div>
                                                          <div><font face="arial,
                                                          helvetica,
                                                          sans-serif">But




                                                          I'd like to
                                                          understand if
                                                          this is still
                                                          a problem.</font></div>
                                                          <div><font face="arial,
                                                          helvetica,
                                                          sans-serif">It
                                                          should be
                                                          added to the
                                                          zone,
                                                          shouldn't it?</font></div>
                                                          <div><font face="monospace,
                                                          monospace"><br>
                                                          </font></div>
                                                          <div><font face="monospace,
                                                          monospace">$
                                                          ipa-client-install
                                                          --mkhomedir
                                                          --ssh-trust-dns
                                                          --force-ntpd</font></div>
                                                          <div><font face="monospace,
                                                          monospace">Discovery



                                                          was
                                                          successful!</font></div>
                                                          <div><font face="monospace,
                                                          monospace">Hostname:



                                                          <a href="http://photon.example.com" target="_blank">photon.example.com</a></font></div>
                                                          <div>
                                                          <div>
                                                          <div><font face="monospace,
                                                          monospace">Realm:



                                                          <a href="http://HQ.EXAMPLE.COM" target="_blank">HQ.EXAMPLE.COM</a></font></div>
                                                          <div><font face="monospace,
                                                          monospace">DNS
                                                          Domain: <a href="http://hq.example.com" target="_blank">hq.example.com</a></font></div>
                                                          <div><font face="monospace,
                                                          monospace">IPA
                                                          Server: <a href="http://ipa.hq.example.com" target="_blank">ipa.hq.example.com</a></font></div>
                                                          <div><font face="monospace,
                                                          monospace">BaseDN:
dc=hq,dc=example,dc=com</font></div>
                                                          <div><font face="monospace,
                                                          monospace"><br>
                                                          </font></div>
                                                          <div><font face="monospace,
                                                          monospace">Continue



                                                          to configure
                                                          the system
                                                          with these
                                                          values? [no]:
                                                          yes</font></div>
                                                          <div><font face="monospace,
                                                          monospace">Synchronizing




                                                          time with
                                                          KDC...</font></div>
                                                          <div><font color="#ff0000" face="monospace,




                                                          monospace"><b>Unable



                                                          to sync time
                                                          with IPA NTP
                                                          server,
                                                          assuming the
                                                          time is in
                                                          sync. Please
                                                          check that 123
                                                          UDP port is
                                                          opened.</b></font></div>
                                                          <div><font face="monospace,
                                                          monospace">User




                                                          authorized to
                                                          enroll
                                                          computers:
                                                          admin</font></div>
                                                          <div><font face="monospace,
                                                          monospace">Password



                                                          for <a href="mailto:admin@HQ.EXAMPLE.COM" target="_blank">admin@HQ.EXAMPLE.COM</a>:</font></div>
                                                          <div><font face="monospace,
                                                          monospace">Successfully




                                                          retrieved CA
                                                          cert</font></div>
                                                          <div><font face="monospace,
                                                          monospace">   
                                                          Subject:    
                                                          CN=Certificate
                                                          Authority,O=<a href="http://HQ.EXAMPLE.COM" target="_blank">HQ.EXAMPLE.COM</a></font></div>
                                                          <div><font face="monospace,
                                                          monospace">   
                                                          Issuer:    
                                                           CN=Certificate
                                                          Authority,O=<a href="http://HQ.EXAMPLE.COM" target="_blank">HQ.EXAMPLE.COM</a></font></div>
                                                          <div><font face="monospace,
                                                          monospace">   
                                                          Valid From:
                                                           Mon Mar 16
                                                          18:44:35 2015
                                                          UTC</font></div>
                                                          <div><font face="monospace,
                                                          monospace">   
                                                          Valid Until:
                                                          Fri Mar 16
                                                          18:44:35 2035
                                                          UTC</font></div>
                                                          <div><font face="monospace,
                                                          monospace"><br>
                                                          </font></div>
                                                          <div><font face="monospace,
                                                          monospace">Enrolled



                                                          in IPA realm <a href="http://HQ.EXAMPLE.COM" target="_blank">HQ.EXAMPLE.COM</a></font></div>
                                                          <div><font face="monospace,
                                                          monospace">Created
/etc/ipa/default.conf</font></div>
                                                          <div><font face="monospace,
                                                          monospace">New
                                                          SSSD config
                                                          will be
                                                          created</font></div>
                                                          <div><font face="monospace,
                                                          monospace">Configured




                                                          sudoers in
                                                          /etc/nsswitch.conf</font></div>
                                                          <div><font face="monospace,
                                                          monospace">Configured
/etc/sssd/sssd.conf</font></div>
                                                          <div><font face="monospace,
                                                          monospace">Configured




                                                          /etc/krb5.conf
                                                          for IPA realm
                                                          <a href="http://HQ.EXAMPLE.COM" target="_blank">HQ.EXAMPLE.COM</a></font></div>
                                                          <div><font face="monospace,
                                                          monospace">trying



                                                          <a href="https://ipa.hq.example.com/ipa/json" target="_blank">https://ipa.hq.example.com/ipa/json</a></font></div>
                                                          <div><font face="monospace,
                                                          monospace">Forwarding




                                                          'ping' to json
                                                          server '<a href="https://ipa.hq.example.com/ipa/json" target="_blank">https://ipa.hq.example.com/ipa/json</a>'</font></div>
                                                          <div><font face="monospace,
                                                          monospace">Forwarding




                                                          'ca_is_enabled'



                                                          to json server
                                                          '<a href="https://ipa.hq.example.com/ipa/json" target="_blank">https://ipa.hq.example.com/ipa/json</a>'</font></div>
                                                          <div><font face="monospace,
                                                          monospace">Systemwide



                                                          CA database
                                                          updated.</font></div>
                                                          <div><font face="monospace,
                                                          monospace">Added



                                                          CA
                                                          certificates
                                                          to the default
                                                          NSS database.</font></div>
                                                          </div>
                                                          </div>
                                                          <span>
                                                          <div><font face="monospace,
                                                          monospace">Adding



                                                          SSH public key
                                                          from
                                                          /etc/ssh/ssh_host_rsa_key.pub</font></div>
                                                          </span><span>
                                                          <div><font face="monospace,
                                                          monospace">Adding



                                                          SSH public key
                                                          from
                                                          /etc/ssh/ssh_host_ed25519_key.pub</font></div>
                                                          </span>
                                                          <div><font face="monospace,
                                                          monospace">Adding



                                                          SSH public key
                                                          from
                                                          /etc/ssh/ssh_host_dsa_key.pub</font></div>
                                                          <span>
                                                          <div><font face="monospace,
                                                          monospace">Adding



                                                          SSH public key
                                                          from
                                                          /etc/ssh/ssh_host_ecdsa_key.pub</font></div>
                                                          </span><span>
                                                          <div><font face="monospace,
                                                          monospace">Forwarding




                                                          'host_mod' to
                                                          json server '<a href="https://ipa.hq.example.com/ipa/json" target="_blank">https://ipa.hq.example.com/ipa/json</a>'</font></div>
                                                          <div><font color="#ff0000" face="monospace,




                                                          monospace"><b>Could



                                                          not update DNS
                                                          SSHFP records.</b></font></div>
                                                          <div><font face="monospace,
                                                          monospace">SSSD



                                                          enabled</font></div>
                                                          <div><font face="monospace,
                                                          monospace">Configured
/etc/openldap/ldap.conf</font></div>
                                                          </span><span>
                                                          <div><font face="monospace,
                                                          monospace">NTP
                                                          enabled</font></div>
                                                          <div><font face="monospace,
                                                          monospace">Configured
/etc/ssh/ssh_config</font></div>
                                                          <div><font face="monospace,
                                                          monospace">Configured
/etc/ssh/sshd_config</font></div>
                                                          <div><font face="monospace,
                                                          monospace">Configuring



                                                          <a href="http://hq.example.com" target="_blank">hq.example.com</a> as NIS
                                                          domain.</font></div>
                                                          <div><font face="monospace,
                                                          monospace">Client




                                                          configuration
                                                          complete.</font></div>
                                                          </span></div>
                                                          <div><br>
                                                          </div>
                                                          </div>
                                                          </blockquote>
                                                          </div>
                                                          <br>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          <br>
                                                          <fieldset></fieldset>
                                                          <br>
                                                          </blockquote>
                                                          <br>
                                                          It is
                                                          different. It
                                                          does not have
                                                          the same
                                                          failure about
                                                          admin as you
                                                          had in the
                                                          first email.<br>
                                                          So may be it
                                                          is the
                                                          permissions
                                                          issue and a
                                                          separate NTP
                                                          issue?<br>
                                                          Did you play
                                                          with any
                                                          permissions on
                                                          the server
                                                          side?<br>
                                                          <br>
                                                          <br>
                                                          <pre cols="72">-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
                                                          </div>
                                                          <br>
                                                          </div>
                                                          </div>
                                                          <span>--<br>
                                                          Manage your
                                                          subscription
                                                          for the
                                                          Freeipa-users
                                                          mailing list:<br>
                                                          <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
                                                          Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for
                                                          more info on
                                                          the project<br>
                                                          </span></blockquote>
                                                          </div>
                                                          </div>
                                                          </blockquote>
                                                          </div>
                                                          <br>
                                                          </div>
                                                          <br>
                                                          <fieldset></fieldset>
                                                          <br>
                                                          </blockquote>
                                                          <br>
                                                          <br>
                                                          <pre cols="72">-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          <br>
                                                          --<br>
                                                          Manage your
                                                          subscription
                                                          for the
                                                          Freeipa-users
                                                          mailing list:<br>
                                                          <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
                                                          Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for
                                                          more info on
                                                          the project<br>
                                                          </blockquote>
                                                          </div>
                                                          <br>
                                                          </div>
                                                          <br>
                                                          <fieldset></fieldset>
                                                          <br>
                                                          </blockquote>
                                                          <br>
                                                          <br>
                                                          <pre cols="72">-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
                                                          </div>
                                                          </div>
                                                          </div>
                                                          <br>
                                                          --<br>
                                                          Manage your
                                                          subscription
                                                          for the
                                                          Freeipa-users
                                                          mailing list:<br>
                                                          <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
                                                          Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for
                                                          more info on
                                                          the project<br>
                                                          </blockquote>
                                                          </div>
                                                          <br>
                                                          </div>
                                                          </div>
                                                          <br>
                                                          <fieldset></fieldset>
                                                          <br>
                                                          </blockquote>
                                                          <br>
                                                          <br>
                                                          <pre cols="72">-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
                                                        </div>
                                                      </div>
                                                    </div>
                                                    <br>
                                                    --<br>
                                                    Manage your
                                                    subscription for the
                                                    Freeipa-users
                                                    mailing list:<br>
                                                    <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
                                                    Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for
                                                    more info on the
                                                    project<br>
                                                  </blockquote>
                                                </div>
                                                <br>
                                              </div>
                                            </div>
                                          </div>
                                        </div>
                                        <br>
                                        <fieldset></fieldset>
                                        <br>
                                      </blockquote>
                                      <br>
                                      <br>
                                      <pre cols="72">-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
                                    </div>
                                  </div>
                                </div>
                                <br>
                                --<br>
                                Manage your subscription for the
                                Freeipa-users mailing list:<br>
                                <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
                                Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a>
                                for more info on the project<br>
                              </blockquote>
                            </div>
                            <br>
                          </div>
                        </div>
                      </div>
                    </blockquote>
                  </div>
                  <br>
                </div>
              </div>
            </div>
          </blockquote>
        </div>
        <br>
      </div>
      <br>
      <fieldset></fieldset>
      <br>
    </blockquote>
    <br>
    <br>
    <pre cols="72">-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
  </div>

<br>--<br>
Manage your subscription for the Freeipa-users mailing list:<br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
Go to <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project<br></blockquote></div>