<div dir="ltr"><div><div dir="ltr"><div>Hi all, I hoped I may glean some brilliance from the group.</div><div>I have a Freeipa Server sitting atop a Fedora 21 server. The initial plan was to replicate users+passwords with Windows 2012R2 server but following some of the information in the other posts and docs we've moved to a trust. The trust has been setup using the documentation and in short it's worked without issue. I'm able to get principles from the Windows realm (<a href="http://marvel.comics.com" target="_blank">marvel.comics.com</a>). So what I'm attempting and failing to do is authenticating my IPA users to the Windows 8 desktops. Ideally I don't want any users in AD, it's simply there to deliver a GPO and in the next year it will be phased out and we'll be replacing Windows 8 with linux desktops.</div><div><br></div><div>So </div><div><a href="http://marvel.comics.com" target="_blank">marvel.comics.com</a> = windows</div><div><a href="http://dc.comics.com" target="_blank">dc.comics.com</a> = freeipa</div><div><div><br></div><div># rpm -qi freeipa-server</div><div>Name : freeipa-server</div><div>Version : 4.1.4</div><div>Release : 1.fc21</div><div>Architecture: x86_64</div><div>Install Date: Tue 25 Aug 2015 08:17:56 PM UTC</div><div>Group : System Environment/Base</div><div>Size : 4521059</div><div>License : GPLv3+</div><div>Signature : RSA/SHA256, Thu 26 Mar 2015 10:58:02 PM UTC, Key ID 89ad4e8795a43f54</div><div>Source RPM : freeipa-4.1.4-1.fc21.src.rpm</div><div>Build Date : Thu 26 Mar 2015 03:16:19 PM UTC</div><div>Build Host : <a href="http://buildhw-07.phx2.fedoraproject.org">buildhw-07.phx2.fedoraproject.org</a></div></div><div><div>[root@freeipaServer slapd-DEV-MOSAIC451-COM]# uname -a</div><div>Linux <a href="http://freeipaServer.dc.comics.com">freeipaServer.dc.comics.com</a> 4.1.6-100.fc21.x86_64 #1 SMP Mon Aug 17 22:20:37 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux</div><div>[root@freeipaServer slapd-DEV-MOSAIC451-COM]# cat /etc/redhat-release</div><div>Fedora release 21 (Twenty One)</div></div><div><br></div><div>To cut to the chase here's me logging into a Windows 8 desktop system. I try to login 3 different ways; this system is a member of the marvel domain. Time is extremely close, close enough that I feel really good about ruling it out. Any light you all could shed on this would be outstanding. Thank you all for your time on this, I really appreciate all the time and effort this team puts into reading these posts. </div><div><br></div><div>Username: dc/greenlantern</div><div>Password: ************</div><div><div><br></div><div>[root@freeipaServer slapd-DC-COMICS-COM]# tail -f * | egrep --color -i greenlantern</div><div>[30/Sep/2015:17:55:33 +0000] conn=1172 op=46 SRCH base="dc=dc,dc=comics,dc=com" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=greenlantern@dc)(krbPrincipalName=greenlantern@dc)))" attrs="krbPrincipalName krbCanonicalName ipaKrbPrincipalAlias krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass"</div><div><br></div><div>Username: greenlanter@dc<br></div><div>Password: ************<br></div><div><br></div><div><br class="">[30/Sep/2015:17:59:48 +0000] conn=1172 op=86 SRCH base="dc=dc,dc=comics,dc=com" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=greenlantern@dc)(krbPrincipalName=greenlantern@dc)))" attrs="krbPrincipalName krbCanonicalName ipaKrbPrincipalAlias krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass"<br></div><div><br></div><div><br></div><div>Username: <a href="mailto:greenlanter@dc.comics.com" target="_blank">greenlanter@dc.comics.com</a><br></div><div>Password: ************<br></div><div><br></div><div>[30/Sep/2015:17:59:35 +0000] conn=1172 op=84 SRCH base="dc=dc,dc=comics,dc=com" scope=2 filter="(&(|(objectClass=krbprincipalaux)(objectClass=krbprincipal)(objectClass=ipakrbprincipal))(|(ipaKrbPrincipalAlias=greenlantern\5C@dc.COMICS.com@<a href="http://dc.comics.com/" target="_blank">DC.COMICS.COM</a>)(krbPrincipalName=greenlantern\5C@dc.COMICS.com@<a href="http://dc.comics.com/" target="_blank">DC.COMICS.COM</a>)))" attrs="krbPrincipalName krbCanonicalName ipaKrbPrincipalAlias krbUPEnabled krbPrincipalKey krbTicketPolicyReference krbPrincipalExpiration krbPasswordExpiration krbPwdPolicyReference krbPrincipalType krbPwdHistory krbLastPwdChange krbPrincipalAliases krbLastSuccessfulAuth krbLastFailedAuth krbLoginFailedCount krbExtraData krbLastAdminUnlock krbObjectReferences krbTicketFlags krbMaxTicketLife krbMaxRenewableAge nsAccountLock passwordHistory ipaKrbAuthzData ipaUserAuthType ipatokenRadiusConfigLink objectClass"</div></div><div><br></div><div><br></div><div>From what I can tell, everything looks good to wbinfo; we see the domain and he see's us. In the AD trust I can go under the trust and validate the trust with no issues. <br></div><div><div>[root@freeipaServer slapd-MARVEL-COMICS-COM]# wbinfo --online-status</div><div>BUILTIN : online</div><div>DC : online</div><div>MARVEL : online</div><div>[root@freeipaServer slapd-MARVEL-COMICS-COM]# wbinfo --domain-info <a href="http://marvel.comics.com" target="_blank">marvel.comics.com</a></div><div>Name : MARVEL</div><div>Alt_Name : <a href="http://marvel.comics.com" target="_blank">marvel.comics.com</a></div><div>SID : S-1-5-21-3495301974-2766379234-3984916731</div><div>Active Directory : Yes</div><div>Native : Yes</div><div>Primary : No</div><div>[root@freeipaServer slapd-MARVEL-COMICS-COM]# wbinfo -n '<a href="http://MARVEL.COMICS.COM" target="_blank">MARVEL.COMICS.COM</a>\Domain Admins'</div><div>S-1-5-21-3495301974-2766379234-3984916731-512 SID_DOM_GROUP (2)</div><div>[root@freeipaServer slapd-MARVEL-COMICS-COM]# wbinfo --domain-info <a href="http://marvel.comics.com" target="_blank">marvel.comics.com</a></div><div>Name : MARVEL</div><div>Alt_Name : <a href="http://marvel.comics.com" target="_blank">marvel.comics.com</a></div><div>SID : S-1-5-21-3495301974-2766379234-3984916731</div><div>Active Directory : Yes</div><div>Native : Yes</div><div>Primary : No</div></div></div></div>
</div>