<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 11/13/2014 08:15 AM, Jonathan
Bradford wrote:<br>
</div>
<blockquote
cite="mid:CACPMiH_iOtH=0-4zd6OwmVvf8UPWoZCsAj9aXn_qSBq5CxSMxg@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>Dmitri:</div>
<div> </div>
<div>Thanks for the reply. </div>
<div> </div>
<div>> Do you need to repair the trust for every single user
or just once?</div>
<div>Yes, I have to repair the trust for every new user added to
Active Directory who needs access to an IdM resource. Only
once per user though.</div>
<div> </div>
<div>> What it is your AD domain topology?</div>
<div>My AD topology is very simple at the moment because it is a
test environment. I currently have one domain controller with
a domain of <a moz-do-not-send="true" href="http://venus.com">venus.com</a>.
My IdM topology is very similar--one IdM server with a domain
of <a moz-do-not-send="true" href="http://mercury.com">mercury.com</a>.</div>
<div> </div>
<div>> Are you establishing trust with the primary domain
controller?</div>
<div>Yes.</div>
<div> </div>
<div>> What version of IPA and AD are you using?</div>
<div>I'm using IPA v 3.0. I'm not sure of the current version of
AD, but I'm using it on Windows Server 2008 R2 SP1.</div>
</div>
</blockquote>
<br>
3.0 is a pretty old version, I mean a lot has changed in trust area
between 3.0 and 3.3.<br>
Any chance you can use that?<br>
<br>
What distro do you use?<br>
<br>
<blockquote
cite="mid:CACPMiH_iOtH=0-4zd6OwmVvf8UPWoZCsAj9aXn_qSBq5CxSMxg@mail.gmail.com"
type="cite">
<div dir="ltr">
<div> </div>
<div>----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Wed, 12 Nov 2014 14:42:51 -0500<br>
From: Dmitri Pal <<a moz-do-not-send="true"
href="mailto:dpal@redhat.com"><font color="#0066cc">dpal@redhat.com</font></a>><br>
To: <a moz-do-not-send="true"
href="mailto:freeipa-users@redhat.com"><font color="#0066cc">freeipa-users@redhat.com</font></a><br>
Subject: Re: [Freeipa-users] Unable to Login until Trust is
Repaired<br>
Message-ID: <<a moz-do-not-send="true"
href="mailto:5463B83B.1040601@redhat.com"><font
color="#0066cc">5463B83B.1040601@redhat.com</font></a>><br>
Content-Type: text/plain; charset="iso-8859-1";
Format="flowed"<br>
<br>
On 11/12/2014 08:44 AM, Jonathan Bradford wrote:<br>
> This is my first post on the IPA mailing list. Hey guys
:)<br>
> I've successfully walked through the IdM Red Hat document
on<br>
> "Integrating with Active Directory Through Cross-Realm
Kerberos<br>
> Trusts" using separate DNS domains. I've reached the part
where you<br>
> test the trust using SSH via PuTTY, and I have noticed a
problem.<br>
> If I add a user in Active Directory (group mapping is
on), the user<br>
> cannot immediately SSH to an IPA host. In fact, it never
allows me to<br>
> login until I first login to a Windows machine with the
account and<br>
> then repair the trust via AD.<br>
> To repair the trust, I have to go to AD Domains and
Trusts ><br>
> Properties > Trusts> and Validate the incoming and
outgoing<br>
> connections. When I do this, it gives me an error message
about the<br>
> RPC server not running, but if I proceed, it eventually
tells me that<br>
> the connection has been repaired. Only after doing this
can I<br>
> successfully SSH with a new user.<br>
> Do you have any idea why this might be happening? I have
followed Red<br>
> Hat's documentation exactly, so I am not sure why I am
having issues.<br>
> If you have any thoughts or ideas, I would greatly
appreciate them.<br>
> Thanks!<br>
> -Jonathan<br>
> <br>
> <br>
HI Jonathan,<br>
<br>
I would leave to Alexander to drill down into the details when
he is<br>
back online <span tabindex="0"><span>tomorrow</span></span>
however if the trust is not validated then it is<br>
not fully established the first time. Something when wrong and
it would<br>
be nice to look at the logs on the IPA and AD side to be able
to<br>
determine the cause.<br>
Do you need to repair the trust for every single user or just
once?<br>
<br>
What it is your AD domain topology? Are you establishing trust
with the<br>
primary domain controller?<br>
What version of IPA and AD are you using?<br>
<br>
Thanks<br>
Dmitri<br>
<br>
--<br>
Thank you,<br>
Dmitri Pal<br>
<br>
Sr. Engineering Manager IdM portfolio<br>
Red Hat, Inc.</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IdM portfolio
Red Hat, Inc.</pre>
</body>
</html>