<div dir="ltr"><div>Hi Alexander, thanks for your support. </div><div> These are my open ports after running sssd: # netstat -nltup | grep smbd tcp 0 0 <a href="http://0.0.0.0:139">0.0.0.0:139</a> 0.0.0.0:* LISTEN 3149/smbd tcp 0 0 <a href="http://0.0.0.0:445">0.0.0.0:445</a> 0.0.0.0:* LISTEN 3149/smbd </div>After running SSD error doing trust changes: # ipa trust-add --type=ad <a href="http://mydomain.com">mydomain.com</a> --admin Administrator --password Active Directory domain administrator's password: ipa: ERROR: Cannot find specified domain or server name Logs: ==> /var/log/httpd/error_log <== [Tue Sep 08 15:14:46.486031 2015] [:error] [pid 2221] ipa: INFO: [jsonserver_session] <a href="mailto:admin@IPA.MYDOMAIN.COM">admin@IPA.MYDOMAIN.COM</a>: trust_add(u'<a href="http://mydomain.com">mydomain.com</a>', trust_type=u'ad', realm_admin=u'Administrator', realm_passwd=u'********', realm_server=u'<a href="http://srv01.MYDOMAIN.com">srv01.MYDOMAIN.com</a>', all=False, raw=False, version=u'2.112'): NotFound ==> /var/log/samba/log.winbindd-idmap <== [2015/09/08 15:14:46.482578, 1] ../source3/winbindd/idmap.c:202(idmap_init_domain) idmap range not specified for domain * [2015/09/08 15:14:46.483715, 1] ../source3/winbindd/idmap.c:202(idmap_init_domain) idmap range not specified for domain * But DNS seems ok: ------------------------ # dig SRV _ldap._<a href="http://tcp.ipa.mydomain.com">tcp.ipa.mydomain.com</a> @<a href="http://dc01.mydomain.com">dc01.mydomain.com</a> ; <<>> DiG 9.9.4-RedHat-9.9.4-18.el7_1.5 <<>> SRV _ldap._<a href="http://tcp.ipa.mydomain.com">tcp.ipa.mydomain.com</a> @<a href="http://dc01.mydomain.com">dc01.mydomain.com</a> ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47124 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;_ldap._<a href="http://tcp.ipa.mydomain.com">tcp.ipa.mydomain.com</a>. IN SRV ;; ANSWER SECTION: _ldap._<a href="http://tcp.ipa.mydomain.com">tcp.ipa.mydomain.com</a>. 83913 IN SRV 0 100 389 <a href="http://srv01.ipa.mydomain.com">srv01.ipa.mydomain.com</a>. ;; ADDITIONAL SECTION: <a href="http://srv01.ipa.mydomain.com">srv01.ipa.mydomain.com</a>. 3600 IN A 192.168.0.65 ;; Query time: 1 msec ;; SERVER: 192.168.0.31#53(192.168.0.31) ;; WHEN: Tue Sep 08 15:39:03 CEST 2015 ;; MSG SIZE rcvd: 122 # dig SRV _ldap._<a href="http://tcp.ipa.mydomain.com">tcp.ipa.mydomain.com</a> @localhost <div> ; <<>> DiG 9.9.4-RedHat-9.9.4-18.el7_1.5 <<>> SRV _ldap._<a href="http://tcp.ipa.mydomain.com">tcp.ipa.mydomain.com</a> @localhost ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18190 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;_ldap._<a href="http://tcp.ipa.mydomain.com">tcp.ipa.mydomain.com</a>. IN SRV ;; ANSWER SECTION: _ldap._<a href="http://tcp.ipa.mydomain.com">tcp.ipa.mydomain.com</a>. 86400 IN SRV 0 100 389 <a href="http://srv01.ipa.mydomain.com">srv01.ipa.mydomain.com</a>. ;; AUTHORITY SECTION: <a href="http://ipa.mydomain.com">ipa.mydomain.com</a>. 86400 IN NS <a href="http://srv01.ipa.mydomain.com">srv01.ipa.mydomain.com</a>. ;; ADDITIONAL SECTION: <a href="http://srv01.ipa.mydomain.com">srv01.ipa.mydomain.com</a>. 86400 IN A 192.168.0.65 ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Tue Sep 08 15:32:50 CEST 2015 ;; MSG SIZE rcvd: 136 ------------------------ # dig SRV _ldap._<a href="http://tcp.mydomain.com">tcp.mydomain.com</a> @<a href="http://dc01.mydomain.com">dc01.mydomain.com</a> ; <<>> DiG 9.9.4-RedHat-9.9.4-18.el7_1.5 <<>> SRV _ldap._<a href="http://tcp.mydomain.com">tcp.mydomain.com</a> @<a href="http://dc01.mydomain.com">dc01.mydomain.com</a> ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60503 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 3 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;_ldap._<a href="http://tcp.mydomain.com">tcp.mydomain.com</a>. IN SRV ;; ANSWER SECTION: _ldap._<a href="http://tcp.mydomain.com">tcp.mydomain.com</a>. 600 IN SRV 0 100 389 <a href="http://dc02.mydomain.com">dc02.mydomain.com</a>. _ldap._<a href="http://tcp.mydomain.com">tcp.mydomain.com</a>. 600 IN SRV 0 100 389 <a href="http://dc01.mydomain.com">dc01.mydomain.com</a>. ;; ADDITIONAL SECTION: <a href="http://dc02.mydomain.com">dc02.mydomain.com</a>. 3600 IN A 192.168.0.15 <a href="http://dc01.mydomain.com">dc01.mydomain.com</a>. 3600 IN A 192.168.0.31 ;; Query time: 1 msec ;; SERVER: 192.168.0.31#53(192.168.0.31) ;; WHEN: Tue Sep 08 15:33:27 CEST 2015 ;; MSG SIZE rcvd: 172 # dig SRV _ldap._<a href="http://tcp.mydomain.com">tcp.mydomain.com</a> @localhost ; <<>> DiG 9.9.4-RedHat-9.9.4-18.el7_1.5 <<>> SRV _ldap._<a href="http://tcp.mydomain.com">tcp.mydomain.com</a> @localhost ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36890 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 13, ADDITIONAL: 4 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;_ldap._<a href="http://tcp.mydomain.com">tcp.mydomain.com</a>. IN SRV ;; ANSWER SECTION: _ldap._<a href="http://tcp.mydomain.com">tcp.mydomain.com</a>. 600 IN SRV 0 100 389 <a href="http://dc02.mydomain.com">dc02.mydomain.com</a>. _ldap._<a href="http://tcp.mydomain.com">tcp.mydomain.com</a>. 600 IN SRV 0 100 389 <a href="http://dc01.mydomain.com">dc01.mydomain.com</a>. ;; AUTHORITY SECTION: . 78287 IN NS <a href="http://c.root-servers.net">c.root-servers.net</a>. . 78287 IN NS <a href="http://g.root-servers.net">g.root-servers.net</a>. . 78287 IN NS <a href="http://f.root-servers.net">f.root-servers.net</a>. . 78287 IN NS <a href="http://e.root-servers.net">e.root-servers.net</a>. . 78287 IN NS <a href="http://i.root-servers.net">i.root-servers.net</a>. . 78287 IN NS <a href="http://b.root-servers.net">b.root-servers.net</a>. . 78287 IN NS <a href="http://d.root-servers.net">d.root-servers.net</a>. . 78287 IN NS <a href="http://m.root-servers.net">m.root-servers.net</a>. . 78287 IN NS <a href="http://h.root-servers.net">h.root-servers.net</a>. . 78287 IN NS <a href="http://a.root-servers.net">a.root-servers.net</a>. . 78287 IN NS <a href="http://j.root-servers.net">j.root-servers.net</a>. . 78287 IN NS <a href="http://l.root-servers.net">l.root-servers.net</a>. . 78287 IN NS <a href="http://k.root-servers.net">k.root-servers.net</a>. ;; ADDITIONAL SECTION: <a href="http://dc01.mydomain.com">dc01.mydomain.com</a>. 2702 IN A 192.168.0.31 <a href="http://dc02.mydomain.com">dc02.mydomain.com</a>. 2702 IN A 192.168.0.15 <a href="http://d.root-servers.net">d.root-servers.net</a>. 78287 IN A 199.7.91.13 ;; Query time: 1203 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Tue Sep 08 15:33:12 CEST 2015 ;; MSG SIZE rcvd: 399 ------------------------ </div><div>I've noticed idmap range error in logs, could be a Samba/Winbind problem? </div><div>Thanks, Morgan </div></div><div class="gmail_extra"> <div class="gmail_quote">2015-09-08 15:21 GMT+02:00 Alexander Bokovoy <<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>>: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Tue, 08 Sep 2015, Morgan Marodin wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> I've solved this error, reading this forum: <a href="https://www.redhat.com/archives/freeipa-users/2015-July/msg00247.html" rel="noreferrer" target="_blank">https://www.redhat.com/archives/freeipa-users/2015-July/msg00247.html</a> But now when I try to trust to my Active Directory I see these errors: -------------------- # ipa trust-add --type=ad <a href="http://mydomain.com" rel="noreferrer" target="_blank">mydomain.com</a> --admin Administrator --password Active Directory domain administrator's password: ipa: ERROR: CIFS server communication error: code "-1073741258", message "The connection was refused" (both may be "None") Here my logs: -------------------- ==> /var/log/httpd/error_log <== Failed to connect host 192.168.0.65 on port 135 - NT_STATUS_CONNECTION_REFUSED Failed to connect host 192.168.0.65 (<a href="http://srv01.ipa.mydomain.com" rel="noreferrer" target="_blank">srv01.ipa.mydomain.com</a>) on port 135 - NT_STATUS_CONNECTION_REFUSED. [Tue Sep 08 15:01:50.859313 2015] [:error] [pid 2221] ipa: INFO: [jsonserver_kerb] <a href="mailto:admin@IPA.MYDOMAIN.COM" target="_blank">admin@IPA.MYDOMAIN.COM</a>: trust_add(u'<a href="http://mydomain.com" rel="noreferrer" target="_blank">mydomain.com</a>', trust_type=u'ad', realm_admin=u'Administrator', realm_passwd=u'********', all=False, raw=False, version=u'2.112'): RemoteRetrieveError ==> /var/log/samba/log.192.168.0.65 <== [2015/09/08 15:01:50.833128, 1] ../source3/auth/user_krb5.c:164(get_user_from_kerberos_info) Username IPA\admin is invalid on this system </blockquote> This is your problem. Does your system have SSSD actually running? List of ports that smbd should be listening on on IPA master: # netstat -nltup|grep smbd tcp 0 0 <a href="http://0.0.0.0:135" rel="noreferrer" target="_blank">0.0.0.0:135</a> 0.0.0.0:* LISTEN 12420/smbd tcp 0 0 <a href="http://0.0.0.0:139" rel="noreferrer" target="_blank">0.0.0.0:139</a> 0.0.0.0:* LISTEN 12417/smbd tcp 0 0 <a href="http://0.0.0.0:445" rel="noreferrer" target="_blank">0.0.0.0:445</a> 0.0.0.0:* LISTEN 12417/smbd tcp 0 0 <a href="http://0.0.0.0:1024" rel="noreferrer" target="_blank">0.0.0.0:1024</a> 0.0.0.0:* LISTEN 12422/smbd tcp6 0 0 :::135 :::* LISTEN 12420/smbd tcp6 0 0 :::139 :::* LISTEN 12417/smbd tcp6 0 0 :::445 :::* LISTEN 12417/smbd tcp6 0 0 :::1024 :::* LISTEN 12422/smbd -- / Alexander Bokovoy </blockquote></div> -- <div class="gmail_signature">Morgan Marodin email: <a href="mailto:morgan@marodin.it" target="_blank">morgan@marodin.it</a> mobile: +39.3477829069 </div> </div>