<div dir="rtl"><div dir="ltr">I have recreated the "problem".</div><div dir="ltr">Rebooted the AD and now cannot kinit with AD users.</div><div dir="ltr"><br></div><div dir="ltr"><div dir="ltr">[root@ipaserver1 ~]# KRB5_TRACE=/dev/stdout kinit <a href="mailto:Yoni@BLUE.COM">Yoni@BLUE.COM</a></div><div dir="ltr">[22865] 1411157693.26121: Resolving unique ccache of type KEYRING</div><div dir="ltr">[22865] 1411157693.26167: Getting initial credentials for <a href="mailto:Yoni@BLUE.COM">Yoni@BLUE.COM</a></div><div dir="ltr">[22865] 1411157693.28577: Sending request (156 bytes) to <a href="http://BLUE.COM">BLUE.COM</a></div><div dir="ltr">kinit: Cannot resolve servers for KDC in realm "<a href="http://BLUE.COM">BLUE.COM</a>" while getting initial credentials</div><div><br></div><div>The AD configured as forwarder:</div><div><br></div><div><div>[root@ipaserver1 ~]# ipa dnsconfig-show</div><div> Global forwarders: 192.168.227.60</div></div><div><br></div><div>i can ping the AD machine.</div></div></div><div class="gmail_extra"><br><div class="gmail_quote"><div dir="ltr">2014-09-16 10:28 GMT+03:00 Sumit Bose <span dir="ltr"><<a href="mailto:sbose@redhat.com" target="_blank">sbose@redhat.com</a>></span>:</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Tue, Sep 16, 2014 at 01:39:41AM +0300, Genadi Postrilko wrote:<br> > Hello all !<br> ><br> > I have deployed test environment for AD trust feature, the environment<br> > contains :<br> > Windows Server 2008 - AD Server.<br> > RHEL 7 - IPA 3.3 Server.<br> > RHEL 6.2 - IPA Client.<br> ><br> > I have established the trust as IPA in the sub domain of AD.<br> > AD DNS domain - <a href="http://blue.com" target="_blank">blue.com</a><br> > IPA DNS domain - <a href="http://linux.blue.com" target="_blank">linux.blue.com</a><br> ><br> > All was working fine as i was able to kinit with AD users:<br> ><br> > [root@ipaserver1 ~]# kinit <a href="mailto:Yoni@BLUE.COM">Yoni@BLUE.COM</a><br> > Password for <a href="mailto:Yoni@BLUE.COM">Yoni@BLUE.COM</a>:<br> ><br> > [root@ipaserver1 ~]# klist<br> > Ticket cache: KEYRING:persistent:0:krb_ccache_oi15FrE<br> > Default principal: <a href="mailto:Yoni@BLUE.COM">Yoni@BLUE.COM</a><br> ><br> > Valid starting Expires Service principal<br> > 09/16/2014 01:00:25 09/16/2014 11:00:25 krbtgt/<a href="mailto:BLUE.COM@BLUE.COM">BLUE.COM@BLUE.COM</a><br> > renew until 09/17/2014 01:00:20<br> ><br> > But after i rebooted the Windows Server Machine, i could not kinit with AD<br> > users anymore:<br> > [root@ipaserver1 ~]# kinit <a href="mailto:Yoni@BLUE.COM">Yoni@BLUE.COM</a><br> > kinit: Cannot resolve servers for KDC in realm "<a href="http://BLUE.COM" target="_blank">BLUE.COM</a>" while getting<br> > initial<br> <br> </span>The only IPA component used for kinit is the DNS server. How did you<br> configure DNS (glue records? forwarder?). To get more details about what<br> is failing you can call:<br> <br> KRB5_TRACE=/dev/stdout kinit <a href="mailto:Yoni@BLUE.COM">Yoni@BLUE.COM</a><br> <br> HTH<br> <br> bye,<br> Sumit<br> <div class="HOEnZb"><div class="h5"><br> ><br> > I have checked if all the IPA services where UP:<br> ><br> > [root@ipaserver1 ~]# ipactl status<br> > Directory Service: RUNNING<br> > krb5kdc Service: RUNNING<br> > kadmin Service: RUNNING<br> > named Service: RUNNING<br> > ipa_memcached Service: RUNNING<br> > httpd Service: RUNNING<br> > pki-tomcatd Service: RUNNING<br> > smb Service: RUNNING<br> > winbind Service: RUNNING<br> > ipa-otpd Service: RUNNING<br> > ipa: INFO: The ipactl command was successful<br> ><br> > After i restarted IPA services (ipactl restart), i was able to to kinit<br> > again.<br> > Restarting smb service would do the job as well (?).<br> ><br> > Just wanted to know if it is a know issue, or the AD should be re<br> > discovered if it reboots.<br> > I think i seen an issue about it in the mailing list some time ago (not<br> > sure).<br> ><br> > I did not increase the debug level and got the logs.<br> > But i can share the ipa and sssd version:<br> ><br> > rpm -qa | grep ipa<br> > ipa-server-3.3.3-28.el7_0.1.x86_64<br> > python-iniparse-0.4-9.el7.noarch<br> > libipa_hbac-1.11.2-68.el7_0.5.x86_64<br> > ipa-admintools-3.3.3-28.el7_0.1.x86_64<br> > ipa-server-trust-ad-3.3.3-28.el7_0.1.x86_64<br> > ipa-python-3.3.3-28.el7_0.1.x86_64<br> > sssd-ipa-1.11.2-68.el7_0.5.x86_64<br> > iniparser-3.1-5.el7.x86_64<br> > libipa_hbac-python-1.11.2-68.el7_0.5.x86_64<br> > ipa-client-3.3.3-28.el7_0.1.x86_64<br> ><br> > rpm -qa | grep sssd<br> > sssd-krb5-common-1.11.2-68.el7_0.5.x86_64<br> > sssd-ldap-1.11.2-68.el7_0.5.x86_64<br> > sssd-common-1.11.2-68.el7_0.5.x86_64<br> > sssd-common-pac-1.11.2-68.el7_0.5.x86_64<br> > sssd-ad-1.11.2-68.el7_0.5.x86_64<br> > sssd-krb5-1.11.2-68.el7_0.5.x86_64<br> > sssd-1.11.2-68.el7_0.5.x86_64<br> > python-sssdconfig-1.11.2-68.el7_0.5.noarch<br> > sssd-ipa-1.11.2-68.el7_0.5.x86_64<br> > sssd-proxy-1.11.2-68.el7_0.5.x86_64<br> > sssd-client-1.11.2-68.el7_0.5.x86_64<br> ><br> > Thanks for all the helpers.<br> <br> </div></div><span class="HOEnZb"><font color="#888888">> --<br> > Manage your subscription for the Freeipa-users mailing list:<br> > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br> > Go To <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project<br> <br> </font></span></blockquote></div><br></div>