<div dir="ltr"><div class="gmail_quote"><div dir="ltr">Hello,<div><br></div><div>While following the guide on setting up <a href="http://www.freeipa.org/page/Active_Directory_trust_setup" target="_blank">FreeIPA with AD</a>, I got to the step where I'm adding the AD trust to FreeIPA but I receive an error:</div><div><br></div><div><div> >> Active Directory domain administrator's password:</div><div> >> ipa: ERROR: CIFS server communication error: code "-1073741801",</div><div> >> message "Memory allocation error" (both may be "None")</div></div><div><br></div><div>Thinking that the error was what was stated (my VM at the time only had 1GB of ram), I shutdown my VM (memory hot add was not enabled in VMware, it is now), bumped the RAM to 4GB, and booted the VM.</div><div><br></div><div>Upon running the same command after reboot I received an error:</div><div><br></div><div> >> ipa: ERROR: did not receive Kerberos credentials</div><div><br></div><div>kinit admin is also reporting an error:</div><div><br></div><div> >> kinit: Cannot contact any KDC for realm 'myrealm' while getting initial credentials</div><div><br></div><div>trying to start FreeIPA in debug mode identified the samba service as at fault. </div><div><br></div><div> >> Jan 19 10:19:50 myfreeipaserver smbd[3676]: kerberos error: code=-1765328203, message=Keytab contains no suitable keys for cifs/<a href="mailto:myfreeipaserver@SUB.DOMAIN.MYDOMAIN.COM" target="_blank">myfreeipaserver@SUB.DOMAIN.MYDOMAIN.COM</a></div><div> >> Jan 19 10:19:51 myfreeipaserver smbd[3676]: [2016/01/19 10:19:51.261648, 0] ipa_sam.c:4520(pdb_init_ipasam)</div><div> >> Jan 19 10:19:51 myfreeipaserver smbd[3676]: Failed to get base DN.</div><div> >> Jan 19 10:19:51 myfreeipaserver smbd[3676]: [2016/01/19 10:19:51.262675, 0] ../source3/passdb/pdb_interface.c:179(make_pdb_method_name)</div><div> >> Jan 19 10:19:51 myfreeipaserver smbd[3676]: pdb backend ipasam:ldapi://%2fvar%2frun%2fslapd-SUB-DOMAIN-MYDOMAIN-COM.socket did not correctly init (error was NT_STATUS_UNSUCCESSFUL)</div><div><br></div><div>Googling for these errors turned up a few similar threads but none of the solutions seemed to work and all signs pointed to AD integration as the culprit...</div><div><br></div><div>So I did what any good sysadmin would do and forced freeipa to start while ignoring any failures. Every service except samba starts without issue.</div><div><br></div><div>So I tried my trust connection again, and received the same error, </div><div><br></div><div><div> >> Active Directory domain administrator's password:</div><div> >> ipa: ERROR: CIFS server communication error: code "-1073741801",</div><div> >> message "Memory allocation error" (both may be "None")</div></div><div><br></div><div>Which brought me to googling two bug reports opened on this exact issue:</div><div><br></div><div>>> <a href="https://bugzilla.redhat.com/show_bug.cgi?id=878168" target="_blank">https://bugzilla.redhat.com/show_bug.cgi?id=878168</a><br></div><div>>> <a href="https://fedorahosted.org/freeipa/ticket/3266" target="_blank">https://fedorahosted.org/freeipa/ticket/3266</a></div><div><br></div><div>Both of these bug reports indicate there's an upstream bug in Samba, the bug has been closed and reopened at least once. I did add the AD servers to /etc/hosts and rebooted the server. I have to go through the same process of forcing freeipa to start after the server rebooted... However, I received the same error message. </div><div><br></div><div>While the bug report is currently closed, I seem to be experiencing the same issues...</div><div><br></div><div>Given this bug report, can you please answer me these questions three:</div><div><br></div><div>1) Given the issues with Samba starting after reboot, is this bug report actually what's wrong or is the error message when trying to create a trust a red herring and it's actually samba that's the problem?</div><div>2) Does this bug report mean that trusts between FreeIPA and AD are broken and can not be established until the upstream bug in Samba is fixed?</div><div>3) Is there a workaround? (as adding the domain controllers to /etc/hosts with IPv4 address does not appear to work)</div><div><br></div><div>System Stats:</div><div>- AD Server: Win2k8R2 <br></div><div>- FreeIPA server:<br></div><div><div><br></div><div><div>>> CentOS Linux release 7.2.1511 (Core)</div></div><div><br></div><div><br></div><div>>> # uname -a</div><div>>> Linux myserver 3.10.0-327.4.4.el7.x86_64 #1 SMP Tue Jan 5 16:07:00 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux</div></div><div><br></div><div>>> # rpm -qa | grep ipa<br></div><div><div>>> python-libipa_hbac-1.13.0-40.el7_2.1.x86_64</div><div>>> ipa-server-4.2.0-15.el7.centos.3.x86_64</div><div>>> ipa-server-dns-4.2.0-15.el7.centos.3.x86_64</div><div>>> python-iniparse-0.4-9.el7.noarch</div><div>>> libipa_hbac-1.13.0-40.el7_2.1.x86_64</div><div>>> sssd-ipa-1.13.0-40.el7_2.1.x86_64</div><div>>> ipa-python-4.2.0-15.el7.centos.3.x86_64</div><div>>> ipa-client-4.2.0-15.el7.centos.3.x86_64</div><div>>> ipa-server-trust-ad-4.2.0-15.el7.centos.3.x86_64</div><div>>> ipa-admintools-4.2.0-15.el7.centos.3.x86_64</div></div><div><br></div><div><br></div><div>I appreciate any help. I've been trying to get FreeIPA going for a couple of weeks now and have run into nothing but frustrations. The funny thing is, I've never had a problem deploying FreeIPA by itself... Microsoft seems to be the common denominator in my hair pulling lately... Correlation does not equal causation... but it sure is a coincidence... :)</div><div><br></div><div>Thanks for your time!</div><div><br></div><div>Best Regards,</div><div>Jon A</div></div> </div><br></div>