Hi Sumit, Thank you very much for the prompt reply [root@support1 ~]# ipa trustdomain-find <a href="http://windows.com" target="_blank">windows.com</a> Domain name: <a href="http://windows.com" target="_blank">windows.com</a> Domain NetBIOS name: WINDOWS Domain Security Identifier: S-1-5-21-1701591335-3855227394-3044674468 Domain enabled: True Domain name: <a href="http://acme.windows.com" target="_blank">acme.windows.com</a> Domain NetBIOS name: ACME Domain Security Identifier: S-1-5-21-1215373191-1991333051-3772904882 Domain enabled: True ---------------------------- Number of entries returned 2 ---------------------------- [root@support1 ~]# ipa trust-fetch-domains <a href="http://windows.com" target="_blank">windows.com</a> ------------------------------- No new trust domains were found ------------------------------- ---------------------------- Number of entries returned 0 ---------------------------- Regards <div class="gmail_quote">Le 11 déc. 2014 20:08, "Sumit Bose" <<a href="javascript:_e(%7B%7D,'cvml','sbose@redhat.com');" target="_blank">sbose@redhat.com</a>> a écrit : <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Thu, Dec 11, 2014 at 06:45:49PM +0100, Manuel Lopes wrote: > Hello, > > > We have been following the AD integration guide for IPAv3: > <a href="http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup" target="_blank">http://www.freeipa.org/page/Howto/IPAv3_AD_trust_setup</a> > > > > Our setup is: > > • 2 domain controllers with Windows 2008 R2 AD DC -> <a href="http://windows.com" target="_blank">windows.com</a> > <<a href="http://example.com/" target="_blank">http://example.com/</a>> as Forest Root Domain and <a href="http://acme.windows.com" target="_blank">acme.windows.com</a> > <<a href="http://acme.example.com/" target="_blank">http://acme.example.com/</a>> as transitive child domain > > • RHEL7 as IPA server with domain: <a href="http://linux.com" target="_blank">linux.com</a> > <<a href="http://linux.acme.example.com/" target="_blank">http://linux.acme.example.com/</a>> > > > > We have established a forest trust between <a href="http://windows.com" target="_blank">windows.com</a> and <a href="http://linux.com" target="_blank">linux.com</a> and > everything seems OK from an IPA perspective. > > > > We can work with Kerberos tickets without any issue from “windows” domain > or his child domain “acme”. (kinit, kvno…) > > > > When we use samba tools, the following command is working fine. > > *[root@support1 ]# wbinfo -n 'WINDOWS\Domain Admins'* > > *S-1-5-21-1701591335-3855227394-3044674468-512 SID_DOM_GROUP (2)* > > > > But, the same command against the acme domain returns an error. > > *[root@support1 ]# wbinfo -n 'ACME\Domain Admins'* > > *failed to call wbcLookupName: WBC_ERR_DOMAIN_NOT_FOUND* > > *Could not lookup name ACME\Domain Admins* > > > > Same problem with the following command: > > *[root@support1]# ipa group-add-member ad_users_external --external > "ACME\Domain Users"* > > *[member user]:* > > *[member group]:* > > * Group name: ad_users_external* > > * Description: AD users external map* > > * External member: * > > * Member of groups: ad_users* > > * Failed members:* > > * member user:* > > * member group: ACME\Domain Users: Cannot find specified domain or > server name* > > *-------------------------* > > *Number of members added 0* > > > > > > Any help would be appreciated Does ipa trustdomain-find <a href="http://windows.com" target="_blank">windows.com</a> show <a href="http://acme.windows.com" target="_blank">acme.windows.com</a> as well ? Does ipa trust-fetch-domains ad.devel help to retrieve the child domain? Please note that if <a href="http://acme.windows.com" target="_blank">acme.windows.com</a> now shows up you might have to wait 1-2 minutes until SSSD's negative caches are flushed and the new domains is discovered by SSSD, as an alternative you can just restart SSSD. HTH bye, Sumit > > > > Regards > -- > Manage your subscription for the Freeipa-users mailing list: > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> > Go To <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project -- Manage your subscription for the Freeipa-users mailing list: <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> Go To <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project</blockquote></div>