[Freeipa-users] ipa_get_*_acct request failed: [22]: Invalid argument on IPA client when looking up AD users

[Jakub Hrozek]

On Tue, Aug 09, 2016 at 12:34:04PM +0200, Troels Hansen wrote:
> Hi,I have an sssd client which is currently causing problems when looking up IPA / AD users. 
> 
> # getent passwd drextrha at net.dr.dk 
> returns nothing. 
> 
> # getent passwd admin at linux.dr.dk 
> admin at linux.dr.dk:*:10000:10000:admin admin:/home/admin:/bin/bash 
> 
> works, so it can see the IPA domain. 
> 
> tried re-enrolling the client on IPA server (ipa-client-install --uninstall), didn't make a difftence. 
> 
> SSSD configuration parameters is the same on IPA server, and client. 
> 
> Only thins I can find on the client (loglevel 5) is: 
> (Tue Aug 9 11:33:44 2016) [sssd[be[linux.dr.dk]]] [be_get_account_info] (0x0200): Got request for [0x1001][1][name=drextrha] 
> (Tue Aug 9 11:33:44 2016) [sssd[be[linux.dr.dk]]] [ipa_srv_ad_acct_lookup_done] (0x0040): ipa_get_*_acct request failed: [22]: Invalid argument. 
> (Tue Aug 9 11:33:44 2016) [sssd[be[linux.dr.dk]]] [ipa_subdomain_account_done] (0x0040): ipa_get_*_acct request failed: 22 
> (Tue Aug 9 11:33:44 2016) [sssd[be[linux.dr.dk]]] [acctinfo_callback] (0x0100): Request processed. Returned 3,22,Account info lookup failed 
> 
> Can't grasp what that error covers? 

You need to look into the corresponding server-side sssd logs. See:
    https://fedorahosted.org/sssd/wiki/Troubleshooting
search for 'Common IPA provider issues'.