<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_ym19_1_1467158838997_5854" dir="ltr">Alexander, forwarding sanitized files to you privately</div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1467158838997_5857"><br><br></div><div class="yahoo_quoted" id="yui_3_16_0_ym19_1_1467158838997_5861" style="display: block;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1467158838997_5860"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1467158838997_5859"> <div dir="ltr" id="yui_3_16_0_ym19_1_1467158838997_5858"> <font size="2" face="Arial" id="yui_3_16_0_ym19_1_1467158838997_5864"> <hr size="1"> <b id="yui_3_16_0_ym19_1_1467158838997_5863"><span style="font-weight:bold;" id="yui_3_16_0_ym19_1_1467158838997_5862">From:</span></b> Alexander Bokovoy <abokovoy@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> pgb205 <pgb205@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "Freeipa-users@redhat.com" <Freeipa-users@redhat.com><br> <b id="yui_3_16_0_ym19_1_1467158838997_5881"><span style="font-weight: bold;" id="yui_3_16_0_ym19_1_1467158838997_5880">Sent:</span></b> Tuesday, June 28, 2016 4:25 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] Unable to add external group<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_ym19_1_1467158838997_5883"><br>On Tue, 28 Jun 2016, pgb205 wrote:<div class="yqt9636523172" id="yqtfd67053"><br clear="none">>Trust is successfully established<br clear="none">><br clear="none">>ipa trust-find---------------1 trust matched--------------- Realm name: ad_domain.local Domain NetBIOS name: AD_DOMAIN<br clear="none">>and I can get kerberos ticket and access to servicesKRB5_TRACE=/dev/stderr kvno -S cifs ADDC.AD_DOMAIN<br clear="none">>[3552] 1467143851.633980: Received creds for desired service cifs/ADDC.AD_DOMAIN[3552] 1467143851.634008: Storing <a shape="rect" ymailto="mailto:my_user@AD_DOMAIN" href="mailto:my_user@AD_DOMAIN">my_user@AD_DOMAIN</a> -> cifs/<a shape="rect" ymailto="mailto:ADDC@AD_DOMAIN" href="mailto:ADDC@AD_DOMAIN">ADDC@AD_DOMAIN</a> in KEYRING:persistent:0:krb_ccache_02UjQwjcifs/ADDC.AD_DOMAIN: kvno = 29<br clear="none">>time is also correct and matches on both ipa and Domain Controller<br clear="none">>When I go with the last few steps to add external AD group to the IPA --external I get the followingipa group-add-member ad_domain_admins_external --external 'AD_DOMAIN\Ops_Admins'[member user]:[member group]: Group name: ad_domain_admins_external Description: ad_domain_admins external map Failed members: member user: member group: AD_DOMAIN\Ops_Admins: trusted domain object not found-------------------------Number of members added 0<br clear="none">>I have verified the Ops_Admins is readable by everyone in Active Directory. <br clear="none">>In error_log I get<br clear="none">>[:error] [pid 2619] ipa: INFO: [jsonserver_session] <a shape="rect" ymailto="mailto:admin@IPA_DOMAIN" href="mailto:admin@IPA_DOMAIN">admin@IPA_DOMAIN</a>: group_add_member(u'ad_domain_admins_external', ipaexternalmember=(u'AD_DOMAIN\\\\Ops_Admins',), all=False, raw=False, version=u'2.156', no_members=False): SUCCESS<br clear="none">>Any idea on what steps I'm missing or what other things to check ?</div><br clear="none">If you have "trusted domain object not found", this means you don't<br clear="none">really have trust established correctly. Unfortunately, sometimes we<br clear="none">cannot get proper error message back to the user as Samba Python<br clear="none">bindings don't give us much details.<br clear="none"><br clear="none">See <a shape="rect" href="http://www.freeipa.org/page/Active_Directory_trust_setup#Debugging_trust" target="_blank">http://www.freeipa.org/page/Active_Directory_trust_setup#Debugging_trust </a>on how to generate proper debug logs for trust to see what is there.<br clear="none"><br clear="none">You kvno output is of no use -- obviously AD user would be able to<br clear="none">obtain a ticket to AD DC's service, this is not a surprise.<br clear="none">-- <br clear="none">/ Alexander Bokovoy<div class="yqt9636523172" id="yqtfd35485"><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>