<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_ym19_1_1467602872691_3007"><span></span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990">Selinux is disabled on the server. However, I managed to fix the problem buy adding the AD.DOMAIN {} <br></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr">section to my krb5.conf in addition to IPA.DOMAIN {}. So it now looks like </div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr">[realms]</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr">IPA.DOMAIN{</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr">master_kdc=ipa.dc.ipadomain:port</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr">auth_kdc=ipa.dc.ipadomain:port</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr">...</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr">}</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr"><br></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr">AD.DOMAIN{</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr">master_kdc=ad.dc.addomain:port</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr">auth_kdc=ad.dc.addomain:port</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr">...</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr">}</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr"><br></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr">this had the desired effect although I am not 100 clear on why this worked.</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr"><br></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr">My theory is that we have multiple domain controllers and of course the addomain.com forward zone that was configured prior </div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr">returns a full list. Only the ports to the one ad.dc.addomain.com server have been opened between the ipa and ad servers and so </div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr">when trust command is executed connection goes to some domain controller that IPA can't connect to, eventually generating an error.</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr"><br></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr">Just a theory for now.</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr"><br></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr">thanks</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990" dir="ltr"><br></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467602872691_2990"><br></div><div class="yahoo_quoted" id="yui_3_16_0_ym19_1_1467602872691_2981" style="display: block;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1467602872691_2980"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1467602872691_2979"> <div dir="ltr" id="yui_3_16_0_ym19_1_1467602872691_2978"> <font size="2" face="Arial" id="yui_3_16_0_ym19_1_1467602872691_2977"> <hr size="1" id="yui_3_16_0_ym19_1_1467602872691_2989"> <b><span style="font-weight:bold;">From:</span></b> Alexander Bokovoy <abokovoy@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> pgb205 <pgb205@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "bentech4you@gmail.com" <bentech4you@gmail.com>; Freeipa-users <freeipa-users@redhat.com><br> <b><span style="font-weight: bold;">Sent:</span></b> Friday, July 1, 2016 3:37 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] ipa trust-fetch-domains failing.<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_ym19_1_1467602872691_3050"><br>On Thu, 30 Jun 2016, pgb205 wrote:<div class="yqt7843846004" id="yqtfd92043"><br clear="none">>Ben, do you mind sharing your solution as I am affected by the exact same error when fetching AD domains.</div><br clear="none">I'm currently on vacation and don't have access to my lab, but you need<br clear="none">to check if there are any problems with SELinux. 'ipa<br clear="none">trust-fetch-domains' calls out via DBus to another script. It is<br clear="none">functionally equivalent to the following command run as root:<br clear="none"><br clear="none"># oddjob_request -s com.redhat.idm.trust -o / -i com.redhat.idm.trust com.redhat.idm.trust.fetch_domains ad.test<br clear="none"><br clear="none">where ad.test is your AD root domain.<br clear="none"><br clear="none">If you add 'log level = 100' in /usr/share/ipa/smb.conf.empty, then this<br clear="none">run will generate a lot of debug information.<br clear="none"><br clear="none"><br clear="none">-- <br clear="none">/ Alexander Bokovoy<div class="yqt7843846004" id="yqtfd47271"><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>