<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_ym19_1_1468962449224_2873"><span>Alexander, </span></div><div id="yui_3_16_0_ym19_1_1468962449224_2873"><span><br></span></div><div id="yui_3_16_0_ym19_1_1468962449224_2873" dir="ltr"><span id="yui_3_16_0_ym19_1_1468962449224_2931">regarding your comment about putting stanza on each client.</span></div><div id="yui_3_16_0_ym19_1_1468962449224_2873" dir="ltr"><span id="yui_3_16_0_ym19_1_1468962449224_3003">In our case clients are not on the same network as the Active Directory domain controller.</span></div><div id="yui_3_16_0_ym19_1_1468962449224_2873" dir="ltr"><span id="yui_3_16_0_ym19_1_1468962449224_3004">My plan was to have the Freeipa server as the bridge-head server </span></div><div id="yui_3_16_0_ym19_1_1468962449224_2873" dir="ltr"><span><br></span></div><div id="yui_3_16_0_ym19_1_1468962449224_2873" dir="ltr"><span id="yui_3_16_0_ym19_1_1468962449224_3040">AD DC <-> FIPA server <-> Linux clients</span></div><div id="yui_3_16_0_ym19_1_1468962449224_2873" dir="ltr"><span><br></span></div><div id="yui_3_16_0_ym19_1_1468962449224_2873" dir="ltr"><span id="yui_3_16_0_ym19_1_1468962449224_3118">as it sits on the network that has access to both environments.</span></div><div id="yui_3_16_0_ym19_1_1468962449224_2873" dir="ltr"><span><br></span></div><div id="yui_3_16_0_ym19_1_1468962449224_2873" dir="ltr"><span id="yui_3_16_0_ym19_1_1468962449224_3119">1. If each client has to go out to AD DC to authenticate than what is the purpose of FreeIPA server ? I thought it would act as a proxy to forward authentication requests to AD.</span></div><div id="yui_3_16_0_ym19_1_1468962449224_2873" dir="ltr"><span><br></span></div><div id="yui_3_16_0_ym19_1_1468962449224_2873" dir="ltr"><span id="yui_3_16_0_ym19_1_1468962449224_3154">2. What would be my options in the above situation to get around this requirement -- direct connectivity to Active Directory</span></div><div id="yui_3_16_0_ym19_1_1468962449224_2873" dir="ltr"><span>environment by clients?</span></div><div id="yui_3_16_0_ym19_1_1468962449224_2873" dir="ltr"><span><br></span></div><div id="yui_3_16_0_ym19_1_1468962449224_2873" dir="ltr"><span>thanks </span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1468962449224_2877"><br><br></div><div class="yahoo_quoted" id="yui_3_16_0_ym19_1_1468962449224_3161" style="display: block;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1468962449224_3160"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1468962449224_3159"> <div dir="ltr" id="yui_3_16_0_ym19_1_1468962449224_3158"> <font size="2" face="Arial" id="yui_3_16_0_ym19_1_1468962449224_3162"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Alexander Bokovoy <abokovoy@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> pgb205 <pgb205@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> Freeipa-users <freeipa-users@redhat.com><br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, July 4, 2016 12:02 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] ipa trust-fetch-domains failing.<br> </font> </div> <div class="y_msg_container"><br>On Mon, 04 Jul 2016, pgb205 wrote:<br clear="none">>Selinux is disabled on the server. However, I managed to fix the problem buy adding the AD.DOMAIN {} <br clear="none">>section to my krb5.conf in addition to IPA.DOMAIN {}. So it now looks like [realms]IPA.DOMAIN{master_kdc=ipa.dc.ipadomain:portauth_kdc=ipa.dc.ipadomain:port...}<br clear="none">>AD.DOMAIN{master_kdc=ad.dc.addomain:portauth_kdc=ad.dc.addomain:port...}<br clear="none">>this had the desired effect although I am not 100 clear on why this worked.<br clear="none">>My theory is that we have multiple domain controllers and of course the<br clear="none">>addomain.com forward zone that was configured prior returns a full<br clear="none">>list. Only the ports to the one ad.dc.addomain.com server have been<br clear="none">>opened between the ipa and ad servers and so when trust command is<br clear="none">>executed connection goes to some domain controller that IPA can't<br clear="none">>connect to, eventually generating an error. Just a theory for now.<br clear="none">It is a totally plausible theory -- when we do trust-fetch-domains, we<br clear="none">try to use Kerberos authentication against AD DCs. Forcing IPA master to<br clear="none">use specific domain controller via krb5.conf should help here.<br clear="none"><br clear="none">Note that you'll need to have a similar stanza on each IPA client as<br clear="none">well because authentication happens directly to AD DCs and SSSD on IPA<br clear="none">clients will have to do the same job using AD user credentials in case<br clear="none">of password logons.<br clear="none"><br clear="none"><br clear="none"><br clear="none">>thanks<br clear="none">><br clear="none">> From: Alexander Bokovoy <<a shape="rect" ymailto="mailto:abokovoy@redhat.com" href="mailto:abokovoy@redhat.com">abokovoy@redhat.com</a>><br clear="none">> To: pgb205 <<a shape="rect" ymailto="mailto:pgb205@yahoo.com" href="mailto:pgb205@yahoo.com">pgb205@yahoo.com</a>><br clear="none">>Cc: "<a shape="rect" ymailto="mailto:bentech4you@gmail.com" href="mailto:bentech4you@gmail.com">bentech4you@gmail.com</a>" <<a shape="rect" ymailto="mailto:bentech4you@gmail.com" href="mailto:bentech4you@gmail.com">bentech4you@gmail.com</a>>; Freeipa-users <<a shape="rect" ymailto="mailto:freeipa-users@redhat.com" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a>><br clear="none">> Sent: Friday, July 1, 2016 3:37 AM<br clear="none">> Subject: Re: [Freeipa-users] ipa trust-fetch-domains failing.<br clear="none">><br clear="none">>On Thu, 30 Jun 2016, pgb205 wrote:<br clear="none">>>Ben, do you mind sharing your solution as I am affected by the exact same error when fetching AD domains.<br clear="none">>I'm currently on vacation and don't have access to my lab, but you need<br clear="none">>to check if there are any problems with SELinux. 'ipa<br clear="none">>trust-fetch-domains' calls out via DBus to another script. It is<br clear="none">>functionally equivalent to the following command run as root:<br clear="none">><br clear="none">># oddjob_request -s com.redhat.idm.trust -o / -i com.redhat.idm.trust com.redhat.idm.trust.fetch_domains ad.test<br clear="none">><br clear="none">>where ad.test is your AD root domain.<br clear="none">><br clear="none">>If you add 'log level = 100' in /usr/share/ipa/smb.conf.empty, then this<br clear="none">>run will generate a lot of debug information.<br clear="none">><br clear="none">><br clear="none">>-- <br clear="none">>/ Alexander Bokovoy<br clear="none">><br clear="none">><br clear="none">><br clear="none"><br clear="none">>-- <br clear="none">>Manage your subscription for the Freeipa-users mailing list:<br clear="none">><a shape="rect" href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br clear="none">>Go to <a shape="rect" href="http://freeipa.org/" target="_blank">http://freeipa.org </a>for more info on the project<div class="yqt5720028084" id="yqtfd84137"><br clear="none"><br clear="none"><br clear="none">-- <br clear="none">/ Alexander Bokovoy<br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>