<html><head></head><body data-style="font-family: Monospace;"><div>Hello,</div><div><br></div><div>I have a trust established between Windows Active Directory and IPA. From the IPA server I can get details about AD users but not from a server configured as an IPA client.</div><div><br></div><div>[<a href="mailto:root@ipa">root@ipa</a>_server ~]# getent passwd <a href="mailto:ad_user@ad">ad_user@ad</a>_domain</div><div><a href="mailto:ad_user@ad">ad_user@ad</a>_domain:*:1869402973:1869402973:ADUser Name:/home/ad_domain/ad_user:</div><div><br></div><div>Trying to access details about AD users from a server configured as an IPA client, no results.</div><div><br></div><div>[<a href="mailto:root@ipa">root@ipa</a>_client server ~]# getent passwd <a href="mailto:ad_user@ad">ad_user@ad</a>_domain</div><div>[<a href="mailto:root@ipa">root@ipa</a>_client server ~]#</div><div><br></div><div>I've enabled debugging of sssd. I believe this is the relevant information from /var/log/sssd/sssd_<ipa_domain>.log</div><div><br></div><div>(Mon Jan 25 09:37:39 2016) [sssd[be[ipa_domain]]] [sbus_message_handler] (0x4000): Received SBUS method [getAccountInfo]</div><div>(Mon Jan 25 09:37:39 2016) [sssd[be[ipa_domain]]] [sbus_get_sender_id_send] (0x2000): Not a sysbus message, quit</div><div>(Mon Jan 25 09:37:39 2016) [sssd[be[ipa_domain]]] [sbus_handler_got_caller_id] (0x4000): Received SBUS method [getAccountInfo]</div><div>(Mon Jan 25 09:37:39 2016) [sssd[be[ipa_domain]]] [be_get_account_info] (0x0200): Got request for [0x1001][1][name=ad_user]</div><div>(Mon Jan 25 09:37:39 2016) [sssd[be[ipa_domain]]] [be_req_set_domain] (0x0400): Changing request domain from [ipa_domain] to [ad_domain]</div><div>(Mon Jan 25 09:37:39 2016) [sssd[be[ipa_domain]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection</div><div>(Mon Jan 25 09:37:39 2016) [sssd[be[ipa_domain]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection</div><div>(Mon Jan 25 09:37:39 2016) [sssd[be[ipa_domain]]] [ipa_get_ad_override_connect_done] (0x4000): Searching for overrides in view [Default Trust View] with filter [(&(objectClass=ipaUserOverride)(uid=ad_user))].</div><div>(Mon Jan 25 09:37:39 2016) [sssd[be[ipa_domain]]] [sdap_print_server] (0x2000): Searching <IP of IPA server></div><div>(Mon Jan 25 09:37:39 2016) [sssd[be[ipa_domain]]] [sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [(&(objectClass=ipaUserOverride)(uid=ad_user))][cn=Default Trust View,cn=views,cn=accounts,d</div><div>c=sub_domain,dc=domain].</div><div>(Mon Jan 25 09:37:39 2016) [sssd[be[ipa_domain]]] [sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 9</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [sdap_process_result] (0x2000): Trace: sh[0xa88e70], connected[1], ops[0xa957b0], ldap[0xa8a650]</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [sdap_get_generic_op_finished] (0x0400): Search result: Success(0), no errmsg set</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [ipa_get_ad_override_done] (0x4000): No override found with filter [(&(objectClass=ipaUserOverride)(uid=ad_user))].</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [sdap_id_op_destroy] (0x4000): releasing operation connection</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [sdap_id_op_connect_step] (0x4000): reusing cached connection</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [ipa_s2n_exop_send] (0x0400): Executing extended operation</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [ipa_s2n_exop_send] (0x2000): ldap_extended_operation sent, msgid = 10</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [sdap_process_result] (0x2000): Trace: sh[0xa88e70], connected[1], ops[0xa9d0c0], ldap[0xa8a650]</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [sdap_process_result] (0x2000): Trace: sh[0xa88e70], connected[1], ops[0xa9d0c0], ldap[0xa8a650]</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [sdap_process_message] (0x4000): Message type: [LDAP_RES_EXTENDED]</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: No such object(32), (null).</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [ipa_s2n_get_user_done] (0x0040): s2n exop request failed.</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [sdap_id_op_done] (0x4000): releasing operation connection</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [sdap_id_op_destroy] (0x4000): releasing operation connection</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [acctinfo_callback] (0x0100): Request processed. Returned 0,0,Success</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [sdap_process_result] (0x2000): Trace: sh[0xa88e70], connected[1], ops[(nil)], ldap[0xa8a650]</div><div>(Mon Jan 25 09:37:40 2016) [sssd[be[ipa_domain]]] [sdap_process_result] (0x2000): Trace: ldap_result found nothing!</div><div><br></div><div>I see two issues, " ldap_extended_operation result: No such object(32), (null)" and "ldap_result found nothing!"</div><div><br></div><div>Using ldapsearch to execute the query from the ipa_server or the ipa_client_server produces no results:</div><div><br></div><div>[<a href="mailto:root@ipa">root@ipa</a>_client_server sssd]# ldapsearch -Y GSSAPI "(&(objectClass=ipaUserOverride)(uid=ad_user))"</div><div>SASL/GSSAPI authentication started</div><div>SASL username: admin@<ipa_domain></div><div>SASL SSF: 56</div><div>SASL data security layer installed.</div><div># extended LDIF</div><div>#</div><div># LDAPv3</div><div># base <dc=sub_domain,dc=domain> (default) with scope subtree</div><div># filter: (&(objectClass=ipaUserOverride)(uid=ad_user))</div><div># requesting: ALL</div><div>#</div><div><br></div><div># search result</div><div>search: 4</div><div>result: 0 Success</div><div><br></div><div># numResponses: 1</div><div><br></div><div>Any help would be greatly appreciated.</div><div><br></div><div>Cameron</div><div><br></div></body></html>