<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_ym19_1_1467143525426_11850"><span id="yui_3_16_0_ym19_1_1467143525426_11851">Trust is successfully established<br></span></div><div id="yui_3_16_0_ym19_1_1467143525426_11850"><span><br></span></div><div id="yui_3_16_0_ym19_1_1467143525426_11852">ipa trust-find</div><div id="yui_3_16_0_ym19_1_1467143525426_11853">---------------</div><div id="yui_3_16_0_ym19_1_1467143525426_11854">1 trust matched</div><div id="yui_3_16_0_ym19_1_1467143525426_11855">---------------</div><div id="yui_3_16_0_ym19_1_1467143525426_11856"> Realm name: ad_domain.local</div><div></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_11857"> Domain NetBIOS name: AD_DOMAIN</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_11857"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_11857">and I can get kerberos ticket and access to services</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_11857">KRB5_TRACE=/dev/stderr kvno -S cifs ADDC.AD_DOMAIN<br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_11978">[3552] 1467143851.633980: Received creds for desired service cifs/ADDC.AD_DOMAIN</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_11979">[3552] 1467143851.634008: Storing my_user@AD_DOMAIN -> cifs/ADDC@AD_DOMAIN in KEYRING:persistent:0:krb_ccache_02UjQwj</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_11980">cifs/ADDC.AD_DOMAIN: kvno = 29</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_11980"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_11980">time is also correct and matches on both ipa and Domain Controller</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_11980"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_11980">When I go with the last few steps to add external AD group to the IPA --external I get the following</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12107">ipa group-add-member ad_domain_admins_external --external 'AD_DOMAIN\Ops_Admins'</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12108">[member user]:</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12109">[member group]:</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12110"> Group name: ad_domain_admins_external</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12111"> Description: ad_domain_admins external map</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12112"> Failed members:</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12113"> member user:</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12114"> member group: AD_DOMAIN\Ops_Admins: trusted domain object not found</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12115">-------------------------</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12116">Number of members added 0</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12116"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12116">I have verified the Ops_Admins is readable by everyone in Active Directory. </div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12116"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12116">In error_log I get<br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12211">[:error] [pid 2619] ipa: INFO: [jsonserver_session] admin@IPA_DOMAIN: group_add_member(u'ad_domain_admins_external', ipaexternalmember=(u'AD_DOMAIN\\\\Ops_Admins',), all=False, raw=False, version=u'2.156', no_members=False): SUCCESS</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12212"><br id="yui_3_16_0_ym19_1_1467143525426_12213"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12117">Any idea on what steps I'm missing or what other things to check ?</div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12117"><br></div><div dir="ltr" id="yui_3_16_0_ym19_1_1467143525426_12117">thanks</div></div></body></html>