<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="EN-US" link="#0563C1" vlink="#954F72"> <div class="WordSection1"> hello<o:p></o:p> <o:p> </o:p> I'm unable to start smb after executing ipa-adtrust-install. <o:p></o:p> the execution of ipa-adtrust-install is:<o:p></o:p> [root@hostname ~]# ipa-adtrust-install --enable-compat --add-agents -d<o:p></o:p> <o:p> </o:p> The log file for this installation can be found in /var/log/ipaserver-install.log<o:p></o:p> ipa : DEBUG /sbin/ipa-adtrust-install was invoked with options: {'enable_compat': True, 'add_agents': True, 'no_msdcs': False, 'rid_base': 1000, 'secondary_rid_base': 100000000, 'netbios_name': None, 'debug': True, 'add_sids': False, 'unattended': False}<o:p></o:p> ipa : DEBUG missing options might be asked for interactively later<o:p></o:p> <o:p> </o:p> ipa : DEBUG IPA version 4.4.0-14.el7_3.6<o:p></o:p> ipa : DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'<o:p></o:p> ipa : DEBUG Loading Index file from '/var/lib/ipa/sysrestore/sysrestore.index'<o:p></o:p> ==============================================================================<o:p></o:p> This program will setup components needed to establish trust to AD domains for<o:p></o:p> the IPA Server.<o:p></o:p> <o:p> </o:p> This includes:<o:p></o:p> * Configure Samba<o:p></o:p> * Add trust related objects to IPA LDAP server<o:p></o:p> <o:p> </o:p> To accept the default shown in brackets, press the Enter key.<o:p></o:p> <o:p> </o:p> ipa : DEBUG importing all plugin modules in ipaserver.plugins...<o:p></o:p> ...<o:p></o:p> ipa : DEBUG importing plugin module ipaserver.plugins.hbac<o:p></o:p> ipa : DEBUG ipaserver.plugins.hbac is not a valid plugin module<o:p></o:p> ...<o:p></o:p> ipa : DEBUG importing plugin module ipaserver.plugins.otp<o:p></o:p> ipa : DEBUG ipaserver.plugins.otp is not a valid plugin module<o:p></o:p> ...<o:p></o:p> ipa : DEBUG importing plugin module ipaserver.plugins.pkinit<o:p></o:p> ipa : DEBUG ipaserver.plugins.pkinit is not a valid plugin module<o:p></o:p> ...<o:p></o:p> ipa : DEBUG Starting external process<o:p></o:p> ipa : DEBUG args=klist -V<o:p></o:p> ipa : DEBUG Process finished, return code=0<o:p></o:p> ipa : DEBUG stdout=Kerberos 5 version 1.14.1<o:p></o:p> <o:p> </o:p> ipa : DEBUG stderr=<o:p></o:p> ipa : DEBUG importing plugin module ipaserver.plugins.rabase<o:p></o:p> ipa : DEBUG ipaserver.plugins.rabase is not a valid plugin module<o:p></o:p> ...<o:p></o:p> ipa : DEBUG importing plugin module ipaserver.plugins.sudo<o:p></o:p> ipa : DEBUG ipaserver.plugins.sudo is not a valid plugin module<o:p></o:p> ...<o:p></o:p> ipa : DEBUG importing plugin module ipaserver.plugins.virtual<o:p></o:p> ipa : DEBUG ipaserver.plugins.virtual is not a valid plugin module<o:p></o:p> ipa : DEBUG importing plugin module ipaserver.plugins.xmlserver<o:p></o:p> IPA generated smb.conf detected.<o:p></o:p> Overwrite smb.conf? [no]: yes<o:p></o:p> Configuring cross-realm trusts for IPA server requires password for user 'admin'.<o:p></o:p> This user is a regular system account used for IPA server administration.<o:p></o:p> <o:p> </o:p> admin password:<o:p></o:p> <o:p> </o:p> ipa : DEBUG Starting external process<o:p></o:p> ipa : DEBUG args=kinit admin<o:p></o:p> ipa : DEBUG Process finished, return code=0<o:p></o:p> ipa : DEBUG stdout=Password for admin@MY.IPA.SUBDOMAIN:<o:p></o:p> <o:p> </o:p> ipa : DEBUG stderr=<o:p></o:p> ipa.ipaserver.plugins.ldap2.ldap2: DEBUG Created connection context.ldap2_48972688<o:p></o:p> ipa.ipaserver.plugins.user.user_show: DEBUG raw: user_show(u'admin', version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.user.user_show: DEBUG user_show(u'admin', rights=False, all=False, raw=False, version=u'2.213', no_members=False)<o:p></o:p> ipa.ipapython.ipaldap.SchemaCache: DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-MY-IPA-SUBDOMAIN.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x4c4c9e0><o:p></o:p> ipa.ipaserver.plugins.group.group_show: DEBUG raw: group_show(u'admins', version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.group.group_show: DEBUG group_show(u'admins', rights=False, all=False, raw=False, version=u'2.213', no_members=False)<o:p></o:p> ipa : DEBUG Searching for objects with missing SID with filter=(&(objectclass=ipaobject)(!(objectclass=mepmanagedentry))(|(objectclass=posixaccount)(objectclass=posixgroup)(objectclass=ipaidobject))(!(ipantsecurityidentifier=*))), base_dn=dc=my,dc=ipa,dc=subdomain<o:p></o:p> <o:p> </o:p> WARNING: 12 existing users or groups do not have a SID identifier assigned.<o:p></o:p> Installer can run a task to have ipa-sidgen Directory Server plugin generate<o:p></o:p> the SID identifier for all these users. Please note, the in case of a high<o:p></o:p> number of users and groups, the operation might lead to high replication<o:p></o:p> traffic and performance degradation. Refer to ipa-adtrust-install(1) man page<o:p></o:p> for details.<o:p></o:p> <o:p> </o:p> Do you want to run the ipa-sidgen task? [no]:<o:p></o:p> <o:p> </o:p> The following operations may take some minutes to complete.<o:p></o:p> Please wait until the prompt is returned.<o:p></o:p> <o:p> </o:p> ipa : DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'<o:p></o:p> ipa.ipapython.ipaldap.SchemaCache: DEBUG flushing ldapi://%2fvar%2frun%2fslapd-MY-IPA-SUBDOMAIN.socket from SchemaCache<o:p></o:p> ipa.ipapython.ipaldap.SchemaCache: DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-MY-IPA-SUBDOMAIN.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x4d5ccf8><o:p></o:p> ipa : DEBUG Configuring CIFS<o:p></o:p> Configuring CIFS<o:p></o:p> ipa : DEBUG [1/22]: stopping smbd<o:p></o:p> [1/22]: stopping smbd<o:p></o:p> ipa : DEBUG Starting external process<o:p></o:p> ipa : DEBUG args=/bin/systemctl is-active smb.service<o:p></o:p> ipa : DEBUG Process finished, return code=3<o:p></o:p> ipa : DEBUG stdout=failed<o:p></o:p> <o:p> </o:p> ipa : DEBUG stderr=<o:p></o:p> ipa : DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'<o:p></o:p> ipa : DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state'<o:p></o:p> ipa : DEBUG Starting external process<o:p></o:p> ipa : DEBUG args=/bin/systemctl stop winbind.service<o:p></o:p> ipa : DEBUG Process finished, return code=0<o:p></o:p> ipa : DEBUG stdout=<o:p></o:p> ipa : DEBUG stderr=<o:p></o:p> ipa : DEBUG Starting external process<o:p></o:p> ipa : DEBUG args=/bin/systemctl stop smb.service<o:p></o:p> ipa : DEBUG Process finished, return code=0<o:p></o:p> ipa : DEBUG stdout=<o:p></o:p> ipa : DEBUG stderr=<o:p></o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG [2/22]: creating samba domain object<o:p></o:p> [2/22]: creating samba domain object<o:p></o:p> ipa.ipapython.ipaldap.SchemaCache: DEBUG flushing ldapi://%2fvar%2frun%2fslapd-MY-IPA-SUBDOMAIN.socket from SchemaCache<o:p></o:p> ipa.ipapython.ipaldap.SchemaCache: DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-MY-IPA-SUBDOMAIN.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x4d5bd40><o:p></o:p> ipa : DEBUG Samba domain object already exists<o:p></o:p> Samba domain object already exists<o:p></o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG [3/22]: creating samba config registry<o:p></o:p> [3/22]: creating samba config registry<o:p></o:p> ipa : DEBUG Starting external process<o:p></o:p> ipa : DEBUG args=/usr/bin/net conf import /tmp/tmpTiRBM4<o:p></o:p> ipa : DEBUG Process finished, return code=0<o:p></o:p> ipa : DEBUG stdout=<o:p></o:p> ipa : DEBUG stderr=<o:p></o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG [4/22]: writing samba config file<o:p></o:p> [4/22]: writing samba config file<o:p></o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG [5/22]: adding cifs Kerberos principal<o:p></o:p> [5/22]: adding cifs Kerberos principal<o:p></o:p> ipa.ipaserver.plugins.service.service_add: DEBUG raw: service_add(u'cifs/hostname.MY.IPA.SUBDOMAIN@MY.IPA.SUBDOMAIN', version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.service.service_add: DEBUG service_add(<ipapython.kerberos.Principal object at 0x4d63110>, force=False, all=False, raw=False, version=u'2.213', no_members=False)<o:p></o:p> ipa.ipaserver.plugins.host.host_show: DEBUG raw: host_show(u'hostname.MY.IPA.SUBDOMAIN', version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.host.host_show: DEBUG host_show(u'hostname.MY.IPA.SUBDOMAIN', rights=False, all=False, raw=False, version=u'2.213', no_members=False)<o:p></o:p> ipa : DEBUG found 1 A records for hostname.MY.IPA.SUBDOMAIN.: XX.XX.XX.XX<o:p></o:p> ipa : DEBUG The DNS response does not contain an answer to the question: hostname.MY.IPA.SUBDOMAIN. IN AAAA<o:p></o:p> ipa : DEBUG Starting external process<o:p></o:p> ipa : DEBUG args=ipa-rmkeytab --principal cifs/hostname.MY.IPA.SUBDOMAIN@MY.IPA.SUBDOMAIN -k /etc/samba/samba.keytab<o:p></o:p> ipa : DEBUG Process finished, return code=0<o:p></o:p> ipa : DEBUG stdout=<o:p></o:p> ipa : DEBUG stderr=Removing principal cifs/hostname.MY.IPA.SUBDOMAIN@MY.IPA.SUBDOMAIN<o:p></o:p> <o:p> </o:p> ipa : DEBUG Removing service credentials cache<o:p></o:p> ipa : DEBUG Ccache path: '/var/run/samba/krb5cc_samba'<o:p></o:p> ipa : DEBUG Starting external process<o:p></o:p> ipa : DEBUG args=/usr/bin/kdestroy -c /var/run/samba/krb5cc_samba<o:p></o:p> ipa : DEBUG Process finished, return code=0<o:p></o:p> ipa : DEBUG stdout=<o:p></o:p> ipa : DEBUG stderr=<o:p></o:p> ipa : DEBUG Starting external process<o:p></o:p> ipa : DEBUG args=ipa-getkeytab --server hostname.MY.IPA.SUBDOMAIN --principal cifs/hostname.MY.IPA.SUBDOMAIN@MY.IPA.SUBDOMAIN -k /etc/samba/samba.keytab<o:p></o:p> ipa : DEBUG Process finished, return code=0<o:p></o:p> ipa : DEBUG stdout=<o:p></o:p> ipa : DEBUG stderr=Keytab successfully retrieved and stored in: /etc/samba/samba.keytab<o:p></o:p> <o:p> </o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG [6/22]: adding cifs and host Kerberos principals to the adtrust agents group<o:p></o:p> [6/22]: adding cifs and host Kerberos principals to the adtrust agents group<o:p></o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG [7/22]: check for cifs services defined on other replicas<o:p></o:p> [7/22]: check for cifs services defined on other replicas<o:p></o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG [8/22]: adding cifs principal to S4U2Proxy targets<o:p></o:p> [8/22]: adding cifs principal to S4U2Proxy targets<o:p></o:p> ipa : DEBUG cifs principal already targeted, nothing to do.<o:p></o:p> cifs principal already targeted, nothing to do.<o:p></o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG [9/22]: adding admin(group) SIDs<o:p></o:p> [9/22]: adding admin(group) SIDs<o:p></o:p> ipa : DEBUG Admin SID already set, nothing to do<o:p></o:p> Admin SID already set, nothing to do<o:p></o:p> ipa : DEBUG Admin group SID already set, nothing to do<o:p></o:p> Admin group SID already set, nothing to do<o:p></o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG [10/22]: adding RID bases<o:p></o:p> [10/22]: adding RID bases<o:p></o:p> ipa : DEBUG RID bases already set, nothing to do<o:p></o:p> RID bases already set, nothing to do<o:p></o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG [11/22]: updating Kerberos config<o:p></o:p> [11/22]: updating Kerberos config<o:p></o:p> ipa : DEBUG 'dns_lookup_kdc' already set to 'true', nothing to do.<o:p></o:p> 'dns_lookup_kdc' already set to 'true', nothing to do.<o:p></o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG [12/22]: activating CLDAP plugin<o:p></o:p> [12/22]: activating CLDAP plugin<o:p></o:p> ipa : DEBUG CLDAP plugin already configured, nothing to do<o:p></o:p> CLDAP plugin already configured, nothing to do<o:p></o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG [13/22]: activating sidgen task<o:p></o:p> [13/22]: activating sidgen task<o:p></o:p> ipa : DEBUG Sidgen task plugin already configured, nothing to do<o:p></o:p> Sidgen task plugin already configured, nothing to do<o:p></o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG [14/22]: configuring smbd to start on boot<o:p></o:p> [14/22]: configuring smbd to start on boot<o:p></o:p> ipa : DEBUG Starting external process<o:p></o:p> ipa : DEBUG args=/bin/systemctl is-enabled smb.service<o:p></o:p> ipa : DEBUG Process finished, return code=1<o:p></o:p> ipa : DEBUG stdout=disabled<o:p></o:p> <o:p> </o:p> ipa : DEBUG stderr=<o:p></o:p> ipa : DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'<o:p></o:p> ipa : DEBUG Saving StateFile to '/var/lib/ipa/sysrestore/sysrestore.state'<o:p></o:p> ipa : DEBUG Starting external process<o:p></o:p> ipa : DEBUG args=/bin/systemctl disable smb.service<o:p></o:p> ipa : DEBUG Process finished, return code=0<o:p></o:p> ipa : DEBUG stdout=<o:p></o:p> ipa : DEBUG stderr=<o:p></o:p> ipa : DEBUG service ADTRUST startup entry already enabled<o:p></o:p> ipa : DEBUG Starting external process<o:p></o:p> ipa : DEBUG args=/bin/systemctl disable smb.service<o:p></o:p> ipa : DEBUG Process finished, return code=0<o:p></o:p> ipa : DEBUG stdout=<o:p></o:p> ipa : DEBUG stderr=<o:p></o:p> ipa : DEBUG service EXTID startup entry already enabled<o:p></o:p> ipa : DEBUG duration: 1 seconds<o:p></o:p> ipa : DEBUG [15/22]: adding special DNS service records<o:p></o:p> [15/22]: adding special DNS service records<o:p></o:p> ipa.ipaserver.plugins.dns.dns_is_enabled: DEBUG raw: dns_is_enabled(version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dns_is_enabled: DEBUG dns_is_enabled(version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnszone_show: DEBUG raw: dnszone_show(u'MY.IPA.SUBDOMAIN', version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnszone_show: DEBUG dnszone_show(<DNS name MY.IPA.SUBDOMAIN.>, rights=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dns_update_system_records: DEBUG raw: dns_update_system_records(version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dns_update_system_records: DEBUG dns_update_system_records(dry_run=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.server.server_find: DEBUG raw: server_find(None, version=u'2.213', no_members=False)<o:p></o:p> ipa.ipaserver.plugins.server.server_find: DEBUG server_find(None, all=False, raw=False, version=u'2.213', no_members=False, pkey_only=False)<o:p></o:p> ipa.ipaserver.plugins.topology.topologysuffix_find: DEBUG raw: topologysuffix_find(None, all=True, raw=True, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.topology.topologysuffix_find: DEBUG topologysuffix_find(None, all=True, raw=True, version=u'2.213', pkey_only=False)<o:p></o:p> ipa.ipaserver.plugins.serverrole.server_role_find: DEBUG raw: server_role_find(None, server_server=u'hostname.MY.IPA.SUBDOMAIN', status=u'enabled', version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.serverrole.server_role_find: DEBUG server_role_find(None, server_server=u'hostname.MY.IPA.SUBDOMAIN', status=u'enabled', all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.serverrole.server_role_find: DEBUG raw: server_role_find(None, server_server=u'OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN', status=u'enabled', version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.serverrole.server_role_find: DEBUG server_role_find(None, server_server=u'OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN', status=u'enabled', all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnszone_show: DEBUG raw: dnszone_show(<DNS name MY.IPA.SUBDOMAIN.>, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnszone_show: DEBUG dnszone_show(<DNS name MY.IPA.SUBDOMAIN.>, rights=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa : DEBUG found 1 1 records for hostname.MY.IPA.SUBDOMAIN.: XX.XX.XX.XX<o:p></o:p> ipa : DEBUG The DNS response does not contain an answer to the question: hostname.MY.IPA.SUBDOMAIN. IN AAAA<o:p></o:p> ipa : DEBUG found 1 1 records for OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.: YY.YY.YY.YY<o:p></o:p> ipa : DEBUG The DNS response does not contain an answer to the question: OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN. IN AAAA<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG raw: dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kerberos.MY.IPA.SUBDOMAIN.>, txtrecord=[u'"MY.IPA.SUBDOMAIN"'], version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kerberos.MY.IPA.SUBDOMAIN.>, txtrecord=(u'"MY.IPA.SUBDOMAIN"',), rights=False, structured=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG raw: dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kerberos._tcp.dc._msdcs.MY.IPA.SUBDOMAIN.>, srvrecord=[u'0 100 88 hostname.MY.IPA.SUBDOMAIN.', u'0 100 88 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'], setattr=[u'idnsTemplateAttribute;cnamerecord=_kerberos._tcp.dc._msdcs.\\{substitutionvariable_ipalocation\\}._locations'], addattr=[u'objectclass=idnsTemplateObject'], version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kerberos._tcp.dc._msdcs.MY.IPA.SUBDOMAIN.>, srvrecord=(u'0 100 88 hostname.MY.IPA.SUBDOMAIN.', u'0 100 88 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'), setattr=(u'idnsTemplateAttribute;cnamerecord=_kerberos._tcp.dc._msdcs.\\{substitutionvariable_ipalocation\\}._locations',), addattr=(u'objectclass=idnsTemplateObject',), rights=False, structured=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG raw: dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kerberos-master._tcp.MY.IPA.SUBDOMAIN.>, srvrecord=[u'0 100 88 hostname.MY.IPA.SUBDOMAIN.', u'0 100 88 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'], setattr=[u'idnsTemplateAttribute;cnamerecord=_kerberos-master._tcp.\\{substitutionvariable_ipalocation\\}._locations'], addattr=[u'objectclass=idnsTemplateObject'], version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kerberos-master._tcp.MY.IPA.SUBDOMAIN.>, srvrecord=(u'0 100 88 hostname.MY.IPA.SUBDOMAIN.', u'0 100 88 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'), setattr=(u'idnsTemplateAttribute;cnamerecord=_kerberos-master._tcp.\\{substitutionvariable_ipalocation\\}._locations',), addattr=(u'objectclass=idnsTemplateObject',), rights=False, structured=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG raw: dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kerberos._udp.MY.IPA.SUBDOMAIN.>, srvrecord=[u'0 100 88 hostname.MY.IPA.SUBDOMAIN.', u'0 100 88 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'], setattr=[u'idnsTemplateAttribute;cnamerecord=_kerberos._udp.\\{substitutionvariable_ipalocation\\}._locations'], addattr=[u'objectclass=idnsTemplateObject'], version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kerberos._udp.MY.IPA.SUBDOMAIN.>, srvrecord=(u'0 100 88 hostname.MY.IPA.SUBDOMAIN.', u'0 100 88 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'), setattr=(u'idnsTemplateAttribute;cnamerecord=_kerberos._udp.\\{substitutionvariable_ipalocation\\}._locations',), addattr=(u'objectclass=idnsTemplateObject',), rights=False, structured=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG raw: dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kerberos._udp.dc._msdcs.MY.IPA.SUBDOMAIN.>, srvrecord=[u'0 100 88 hostname.MY.IPA.SUBDOMAIN.', u'0 100 88 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'], setattr=[u'idnsTemplateAttribute;cnamerecord=_kerberos._udp.dc._msdcs.\\{substitutionvariable_ipalocation\\}._locations'], addattr=[u'objectclass=idnsTemplateObject'], version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kerberos._udp.dc._msdcs.MY.IPA.SUBDOMAIN.>, srvrecord=(u'0 100 88 hostname.MY.IPA.SUBDOMAIN.', u'0 100 88 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'), setattr=(u'idnsTemplateAttribute;cnamerecord=_kerberos._udp.dc._msdcs.\\{substitutionvariable_ipalocation\\}._locations',), addattr=(u'objectclass=idnsTemplateObject',), rights=False, structured=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG raw: dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.MY.IPA.SUBDOMAIN.>, srvrecord=[u'0 100 389 hostname.MY.IPA.SUBDOMAIN.', u'0 100 389 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'], setattr=[u'idnsTemplateAttribute;cnamerecord=_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.\\{substitutionvariable_ipalocation\\}._locations'], addattr=[u'objectclass=idnsTemplateObject'], version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.MY.IPA.SUBDOMAIN.>, srvrecord=(u'0 100 389 hostname.MY.IPA.SUBDOMAIN.', u'0 100 389 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'), setattr=(u'idnsTemplateAttribute;cnamerecord=_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.\\{substitutionvariable_ipalocation\\}._locations',), addattr=(u'objectclass=idnsTemplateObject',), rights=False, structured=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG raw: dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kerberos._tcp.MY.IPA.SUBDOMAIN.>, srvrecord=[u'0 100 88 hostname.MY.IPA.SUBDOMAIN.', u'0 100 88 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'], setattr=[u'idnsTemplateAttribute;cnamerecord=_kerberos._tcp.\\{substitutionvariable_ipalocation\\}._locations'], addattr=[u'objectclass=idnsTemplateObject'], version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kerberos._tcp.MY.IPA.SUBDOMAIN.>, srvrecord=(u'0 100 88 hostname.MY.IPA.SUBDOMAIN.', u'0 100 88 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'), setattr=(u'idnsTemplateAttribute;cnamerecord=_kerberos._tcp.\\{substitutionvariable_ipalocation\\}._locations',), addattr=(u'objectclass=idnsTemplateObject',), rights=False, structured=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG raw: dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kpasswd._udp.MY.IPA.SUBDOMAIN.>, srvrecord=[u'0 100 464 hostname.MY.IPA.SUBDOMAIN.', u'0 100 464 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'], setattr=[u'idnsTemplateAttribute;cnamerecord=_kpasswd._udp.\\{substitutionvariable_ipalocation\\}._locations'], addattr=[u'objectclass=idnsTemplateObject'], version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kpasswd._udp.MY.IPA.SUBDOMAIN.>, srvrecord=(u'0 100 464 hostname.MY.IPA.SUBDOMAIN.', u'0 100 464 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'), setattr=(u'idnsTemplateAttribute;cnamerecord=_kpasswd._udp.\\{substitutionvariable_ipalocation\\}._locations',), addattr=(u'objectclass=idnsTemplateObject',), rights=False, structured=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG raw: dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kpasswd._tcp.MY.IPA.SUBDOMAIN.>, srvrecord=[u'0 100 464 hostname.MY.IPA.SUBDOMAIN.', u'0 100 464 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'], setattr=[u'idnsTemplateAttribute;cnamerecord=_kpasswd._tcp.\\{substitutionvariable_ipalocation\\}._locations'], addattr=[u'objectclass=idnsTemplateObject'], version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kpasswd._tcp.MY.IPA.SUBDOMAIN.>, srvrecord=(u'0 100 464 hostname.MY.IPA.SUBDOMAIN.', u'0 100 464 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'), setattr=(u'idnsTemplateAttribute;cnamerecord=_kpasswd._tcp.\\{substitutionvariable_ipalocation\\}._locations',), addattr=(u'objectclass=idnsTemplateObject',), rights=False, structured=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG raw: dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _ntp._udp.MY.IPA.SUBDOMAIN.>, srvrecord=[u'0 100 123 hostname.MY.IPA.SUBDOMAIN.', u'0 100 123 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'], setattr=[u'idnsTemplateAttribute;cnamerecord=_ntp._udp.\\{substitutionvariable_ipalocation\\}._locations'], addattr=[u'objectclass=idnsTemplateObject'], version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _ntp._udp.MY.IPA.SUBDOMAIN.>, srvrecord=(u'0 100 123 hostname.MY.IPA.SUBDOMAIN.', u'0 100 123 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'), setattr=(u'idnsTemplateAttribute;cnamerecord=_ntp._udp.\\{substitutionvariable_ipalocation\\}._locations',), addattr=(u'objectclass=idnsTemplateObject',), rights=False, structured=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG raw: dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.MY.IPA.SUBDOMAIN.>, srvrecord=[u'0 100 88 hostname.MY.IPA.SUBDOMAIN.', u'0 100 88 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'], setattr=[u'idnsTemplateAttribute;cnamerecord=_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.\\{substitutionvariable_ipalocation\\}._locations'], addattr=[u'objectclass=idnsTemplateObject'], version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.MY.IPA.SUBDOMAIN.>, srvrecord=(u'0 100 88 hostname.MY.IPA.SUBDOMAIN.', u'0 100 88 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'), setattr=(u'idnsTemplateAttribute;cnamerecord=_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.\\{substitutionvariable_ipalocation\\}._locations',), addattr=(u'objectclass=idnsTemplateObject',), rights=False, structured=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG raw: dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name ipa-ca.MY.IPA.SUBDOMAIN.>, arecord=[u'XX.XX.XX.XX', u'YY.YY.YY.YY'], version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name ipa-ca.MY.IPA.SUBDOMAIN.>, arecord=(u'XX.XX.XX.XX', u'YY.YY.YY.YY'), rights=False, structured=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG raw: dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _ldap._tcp.MY.IPA.SUBDOMAIN.>, srvrecord=[u'0 100 389 hostname.MY.IPA.SUBDOMAIN.', u'0 100 389 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'], setattr=[u'idnsTemplateAttribute;cnamerecord=_ldap._tcp.\\{substitutionvariable_ipalocation\\}._locations'], addattr=[u'objectclass=idnsTemplateObject'], version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _ldap._tcp.MY.IPA.SUBDOMAIN.>, srvrecord=(u'0 100 389 hostname.MY.IPA.SUBDOMAIN.', u'0 100 389 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'), setattr=(u'idnsTemplateAttribute;cnamerecord=_ldap._tcp.\\{substitutionvariable_ipalocation\\}._locations',), addattr=(u'objectclass=idnsTemplateObject',), rights=False, structured=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG raw: dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kerberos._udp.Default-First-Site-Name._sites.dc._msdcs.MY.IPA.SUBDOMAIN.>, srvrecord=[u'0 100 88 hostname.MY.IPA.SUBDOMAIN.', u'0 100 88 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'], setattr=[u'idnsTemplateAttribute;cnamerecord=_kerberos._udp.Default-First-Site-Name._sites.dc._msdcs.\\{substitutionvariable_ipalocation\\}._locations'], addattr=[u'objectclass=idnsTemplateObject'], version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kerberos._udp.Default-First-Site-Name._sites.dc._msdcs.MY.IPA.SUBDOMAIN.>, srvrecord=(u'0 100 88 hostname.MY.IPA.SUBDOMAIN.', u'0 100 88 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'), setattr=(u'idnsTemplateAttribute;cnamerecord=_kerberos._udp.Default-First-Site-Name._sites.dc._msdcs.\\{substitutionvariable_ipalocation\\}._locations',), addattr=(u'objectclass=idnsTemplateObject',), rights=False, structured=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG raw: dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _ldap._tcp.dc._msdcs.MY.IPA.SUBDOMAIN.>, srvrecord=[u'0 100 389 hostname.MY.IPA.SUBDOMAIN.', u'0 100 389 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'], setattr=[u'idnsTemplateAttribute;cnamerecord=_ldap._tcp.dc._msdcs.\\{substitutionvariable_ipalocation\\}._locations'], addattr=[u'objectclass=idnsTemplateObject'], version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _ldap._tcp.dc._msdcs.MY.IPA.SUBDOMAIN.>, srvrecord=(u'0 100 389 hostname.MY.IPA.SUBDOMAIN.', u'0 100 389 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'), setattr=(u'idnsTemplateAttribute;cnamerecord=_ldap._tcp.dc._msdcs.\\{substitutionvariable_ipalocation\\}._locations',), addattr=(u'objectclass=idnsTemplateObject',), rights=False, structured=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG raw: dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kerberos-master._udp.MY.IPA.SUBDOMAIN.>, srvrecord=[u'0 100 88 hostname.MY.IPA.SUBDOMAIN.', u'0 100 88 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'], setattr=[u'idnsTemplateAttribute;cnamerecord=_kerberos-master._udp.\\{substitutionvariable_ipalocation\\}._locations'], addattr=[u'objectclass=idnsTemplateObject'], version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.dns.dnsrecord_mod: DEBUG dnsrecord_mod(<DNS name MY.IPA.SUBDOMAIN.>, <DNS name _kerberos-master._udp.MY.IPA.SUBDOMAIN.>, srvrecord=(u'0 100 88 hostname.MY.IPA.SUBDOMAIN.', u'0 100 88 OTHER_IDM_SERVER.MY.IPA.SUBDOMAIN.'), setattr=(u'idnsTemplateAttribute;cnamerecord=_kerberos-master._udp.\\{substitutionvariable_ipalocation\\}._locations',), addattr=(u'objectclass=idnsTemplateObject',), rights=False, structured=False, all=False, raw=False, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.server.server_find: DEBUG raw: server_find(None, version=u'2.213', pkey_only=True)<o:p></o:p> ipa.ipaserver.plugins.server.server_find: DEBUG server_find(None, all=False, raw=False, version=u'2.213', no_members=True, pkey_only=True)<o:p></o:p> ipa.ipaserver.plugins.topology.topologysuffix_find: DEBUG raw: topologysuffix_find(None, all=True, raw=True, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.topology.topologysuffix_find: DEBUG topologysuffix_find(None, all=True, raw=True, version=u'2.213', pkey_only=False)<o:p></o:p> ipa.ipaserver.plugins.location.location_find: DEBUG raw: location_find(None, version=u'2.213')<o:p></o:p> ipa.ipaserver.plugins.location.location_find: DEBUG location_find(None, all=False, raw=False, version=u'2.213', pkey_only=False)<o:p></o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG [16/22]: enabling trusted domains support for older clients via Schema Compatibility plugin<o:p></o:p> [16/22]: enabling trusted domains support for older clients via Schema Compatibility plugin<o:p></o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG [17/22]: restarting Directory Server to take MS PAC and LDAP plugins changes into account<o:p></o:p> [17/22]: restarting Directory Server to take MS PAC and LDAP plugins changes into account<o:p></o:p> ipa : DEBUG Starting external process<o:p></o:p> ipa : DEBUG args=/bin/systemctl restart dirsrv@MY-IPA-SUBDOMAIN.service<o:p></o:p> ipa : DEBUG Process finished, return code=0<o:p></o:p> ipa : DEBUG stdout=<o:p></o:p> ipa : DEBUG stderr=<o:p></o:p> ipa : DEBUG Starting external process<o:p></o:p> ipa : DEBUG args=/bin/systemctl is-active dirsrv@MY-IPA-SUBDOMAIN.service<o:p></o:p> ipa : DEBUG Process finished, return code=0<o:p></o:p> ipa : DEBUG stdout=active<o:p></o:p> <o:p> </o:p> ipa : DEBUG stderr=<o:p></o:p> ipa : DEBUG wait_for_open_ports: localhost [389] timeout 300<o:p></o:p> ipa : DEBUG duration: 5 seconds<o:p></o:p> ipa : DEBUG [18/22]: adding fallback group<o:p></o:p> [18/22]: adding fallback group<o:p></o:p> ipa.ipapython.ipaldap.SchemaCache: DEBUG flushing ldapi://%2fvar%2frun%2fslapd-MY-IPA-SUBDOMAIN.socket from SchemaCache<o:p></o:p> ipa.ipapython.ipaldap.SchemaCache: DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-MY-IPA-SUBDOMAIN.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x4d5ce60><o:p></o:p> ipa : DEBUG Fallback group already set, nothing to do<o:p></o:p> Fallback group already set, nothing to do<o:p></o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG [19/22]: adding Default Trust View<o:p></o:p> [19/22]: adding Default Trust View<o:p></o:p> ipa : DEBUG Default Trust View already exists.<o:p></o:p> Default Trust View already exists.<o:p></o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG [20/22]: setting SELinux booleans<o:p></o:p> [20/22]: setting SELinux booleans<o:p></o:p> ipa : DEBUG Starting external process<o:p></o:p> ipa : DEBUG args=/usr/sbin/selinuxenabled<o:p></o:p> ipa : DEBUG Process finished, return code=1<o:p></o:p> ipa : DEBUG stdout=<o:p></o:p> ipa : DEBUG stderr=<o:p></o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG [21/22]: starting CIFS services<o:p></o:p> [21/22]: starting CIFS services<o:p></o:p> ipa : DEBUG Starting external process<o:p></o:p> ipa : DEBUG args=/bin/systemctl start smb.service<o:p></o:p> ipa : DEBUG Process finished, return code=1<o:p></o:p> ipa : DEBUG stdout=<o:p></o:p> ipa : DEBUG stderr=Job for smb.service failed because the control process exited with error code. See "systemctl status smb.service" and "journalctl -xe" for details.<o:p></o:p> <o:p> </o:p> ipa : CRITICAL CIFS services failed to start<o:p></o:p> ipa : DEBUG duration: 6 seconds<o:p></o:p> ipa : DEBUG [22/22]: restarting smbd<o:p></o:p> [22/22]: restarting smbd<o:p></o:p> ipa : DEBUG duration: 0 seconds<o:p></o:p> ipa : DEBUG Done configuring CIFS.<o:p></o:p> Done configuring CIFS.<o:p></o:p> <o:p> </o:p> ...<o:p></o:p> ipa : DEBUG Starting external process<o:p></o:p> ipa : DEBUG args=kinit admin<o:p></o:p> ipa : DEBUG Process finished, return code=0<o:p></o:p> ipa : DEBUG stdout=Password for admin@MY.IPA.SUBDOMAIN:<o:p></o:p> <o:p> </o:p> ipa : DEBUG stderr=<o:p></o:p> ipa : INFO The ipa-adtrust-install command was successful<o:p></o:p> <o:p> </o:p> On the smb logs I can see:<o:p></o:p> ...<o:p></o:p> [2017/04/10 16:27:58.896485, 11, pid=22584, effective(0, 0), real(0, 0)] ../source3/lib/smbldap.c:1067(smbldap_open)<o:p></o:p> smbldap_open: already connected to the LDAP server<o:p></o:p> [2017/04/10 16:27:58.898224, 0, pid=22584, effective(0, 0), real(0, 0)] ipa_sam.c:3688(ipasam_search_domain_info)<o:p></o:p> iapsam_search_domain_info: Got [2] domain info entries, but expected only 1. <***************************************************************<o:p></o:p> [2017/04/10 16:27:58.898278, 0, pid=22584, effective(0, 0), real(0, 0)] ipa_sam.c:4543(pdb_init_ipasam)<o:p></o:p> pdb_init_ldapsam: WARNING: Could not get domain info, nor add one to the domain. We cannot work reliably without it. <****************************************<o:p></o:p> [2017/04/10 16:27:58.898302, 0, pid=22584, effective(0, 0), real(0, 0), class=passdb] ../source3/passdb/pdb_interface.c:179(make_pdb_method_name)<o:p></o:p> pdb backend ipasam:ldapi://%2fvar%2frun%2fslapd-MY-IPA-SUBDOMAIN.socket did not correctly init (error was NT_STATUS_CANT_ACCESS_DOMAIN_INFO)<o:p></o:p> <o:p> </o:p> I have traced the ipa-adtrust-install and systemctl start smb, but I couldn't get the "domain info entries". Checking the LDAP directory I showed:<o:p></o:p> [root@HOSTNAME]# ldapsearch -w XXXXXXXX -h localhost -s sub -b 'dc=MY,dc=IPA,dc=SUBDOMAIN' -D "cn=Directory Manager" "objectclass=ipaNTDomainAttrs"<o:p></o:p> # extended LDIF<o:p></o:p> #<o:p></o:p> # LDAPv3<o:p></o:p> # base <dc=MY,dc=IPA,dc=SUBDOMAIN> with scope subtree<o:p></o:p> # filter: objectclass=ipaNTDomainAttrs<o:p></o:p> # requesting: ALL<o:p></o:p> #<o:p></o:p> <o:p> </o:p> # my.ipa.subdomain, ad + 773d9684-12f211e7-b1abe436-0243208c, etc, my.ipa.subdomain<o:p></o:p> dn: cn=my.ipa.subdomain,cn=ad+nsuniqueid=773d9684-12f211e7-b1abe436-0243208c,cn=etc,dc=MY,dc=IPA,dc=SUBDOMAIN<o:p></o:p> objectClass: nsContainer<o:p></o:p> objectClass: ipaNTDomainAttrs<o:p></o:p> objectClass: top<o:p></o:p> ipaNTSecurityIdentifier: S-1-5-21-3119812475-2647440479-1423840280<o:p></o:p> cn: my.ipa.subdomain<o:p></o:p> ipaNTDomainGUID: 449b23da-6e30-4fa9-9d34-3426bcec8d0f<o:p></o:p> ipaNTFlatName: IPA<o:p></o:p> <o:p> </o:p> # my.ipa.subdomain, ad, etc, my.ipa.subdomain<o:p></o:p> dn: cn=my.ipa.subdomain,cn=ad,cn=etc,dc=MY,dc=IPA,dc=SUBDOMAIN<o:p></o:p> ipaNTFallbackPrimaryGroup: cn=editors,cn=groups,cn=accounts,dc=MY,dc=IPA,dc=SUBDOMAIN<o:p></o:p> objectClass: nsContainer<o:p></o:p> objectClass: ipaNTDomainAttrs<o:p></o:p> objectClass: top<o:p></o:p> ipaNTSecurityIdentifier: S-1-5-21-1187620393-3629609531-1738010010<o:p></o:p> cn: my.ipa.subdomain<o:p></o:p> ipaNTDomainGUID: 09ec963b-ca7d-4a04-b533-7283d0fac036<o:p></o:p> ipaNTFlatName: IPA<o:p></o:p> <o:p> </o:p> # search result<o:p></o:p> search: 2<o:p></o:p> result: 0 Success<o:p></o:p> <o:p> </o:p> # numResponses: 3<o:p></o:p> # numEntries: 2<o:p></o:p> <o:p> </o:p> But not sure if those are the 2 "Domains info entries".<o:p></o:p> <o:p> </o:p> Can you please let me know how to fix this problem?<o:p></o:p> <o:p> </o:p> ################ The environment: #####################<o:p></o:p> Red Hat Enterprise Linux Server release 7.3 (Maipo)<o:p></o:p> <o:p> </o:p> SELinux status: disabled<o:p></o:p> <o:p> </o:p> Domain level 1<o:p></o:p> <o:p> </o:p> ipa-admintools-4.4.0-14.el7_3.6.noarch<o:p></o:p> ipa-client-4.4.0-14.el7_3.6.x86_64<o:p></o:p> ipa-client-common-4.4.0-14.el7_3.6.noarch<o:p></o:p> ipa-common-4.4.0-14.el7_3.6.noarch<o:p></o:p> ipa-debuginfo-4.4.0-14.el7_3.6.x86_64<o:p></o:p> ipa-python-compat-4.4.0-14.el7_3.6.noarch<o:p></o:p> ipa-server-4.4.0-14.el7_3.6.x86_64<o:p></o:p> ipa-server-common-4.4.0-14.el7_3.6.noarch<o:p></o:p> ipa-server-dns-4.4.0-14.el7_3.6.noarch<o:p></o:p> ipa-server-trust-ad-4.4.0-14.el7_3.6.x86_64<o:p></o:p> libipa_hbac-1.14.0-43.el7_3.11.x86_64<o:p></o:p> python2-ipaclient-4.4.0-14.el7_3.6.noarch<o:p></o:p> python2-ipalib-4.4.0-14.el7_3.6.noarch<o:p></o:p> python2-ipaserver-4.4.0-14.el7_3.6.noarch<o:p></o:p> python-iniparse-0.4-9.el7.noarch<o:p></o:p> python-ipaddress-1.0.16-2.el7.noarch<o:p></o:p> python-libipa_hbac-1.14.0-43.el7_3.11.x86_64<o:p></o:p> sssd-ipa-1.14.0-43.el7_3.11.x86_64<o:p></o:p> <o:p> </o:p> samba-winbind-modules-4.4.4-12.el7_3.x86_64<o:p></o:p> samba-client-4.4.4-12.el7_3.x86_64<o:p></o:p> samba-winbind-clients-4.4.4-12.el7_3.x86_64<o:p></o:p> samba-libs-4.4.4-12.el7_3.x86_64<o:p></o:p> samba-common-tools-4.4.4-12.el7_3.x86_64<o:p></o:p> samba-debuginfo-4.4.4-12.el7_3.x86_64<o:p></o:p> samba-common-4.4.4-12.el7_3.noarch<o:p></o:p> samba-common-libs-4.4.4-12.el7_3.x86_64<o:p></o:p> samba-4.4.4-12.el7_3.x86_64<o:p></o:p> samba-winbind-4.4.4-12.el7_3.x86_64<o:p></o:p> samba-python-4.4.4-12.el7_3.x86_64<o:p></o:p> samba-client-libs-4.4.4-12.el7_3.x86_64<o:p></o:p> <o:p> </o:p> Thank you very much.<o:p></o:p> ______________________________<o:p></o:p> Miguel Soler Sang�esa<o:p></o:p> Consultant – Linux Administrator<o:p></o:p> <o:p> </o:p> </div> </body> </html>