<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>4.2 is a one-way trust, by design.</div><div><br data-mce-bogus="1"></div><div>http://www.freeipa.org/page/V4/One-way_trust</div><div><br data-mce-bogus="1"></div>-Jake<br><br><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>From: </b>"Denis Müller" <d.mueller2@rto.de><br><b>To: </b>"freeipa-users" <freeipa-users@redhat.com><br><b>Sent: </b>Thursday, November 24, 2016 7:48:50 AM<br><b>Subject: </b>[Freeipa-users] Can't establish a trust to AD<br></div><br><div data-marker="__QUOTED_TEXT__"><div>Hello Guys, we need help to establish a trust from freeipa to ad. Ad users should be able to access to linux environment, but linux users not to ad environment.</div>
<div><br>
</div>
<div>our setup:</div>
<div><br>
</div>
<div>AD Domain:</div>
<div>domain.com, there we have two AD-Controllers installed wird Windows Server 2008. All users are managed here.</div>
<div><br>
</div>
<div>IPA Domain:</div>
<div>wop.domain.com. We would like to sync users from ad to a specific group to provide user-management in linux environments. In this subdomain we have 2 ipa-servers: ipa01.wop.domain.com and ipa02.domain.com</div>
<div><br>
</div>
<div>Ipa version on both servers is: VERSION: 4.2.0, API_VERSION: 2.156</div>
<div><br>
</div>
<div>Both serves have "ipa-server-trust-ad" installed.</div>
<div><br>
</div>
<div>[<a href="mailto:root@ipa01" style="cursor: text;" target="_blank">root@ipa01</a> ~]# ipactl status</div>
<div>Directory Service: RUNNING</div>
<div>krb5kdc Service: RUNNING</div>
<div>kadmin Service: RUNNING</div>
<div>named Service: RUNNING</div>
<div>ipa_memcached Service: RUNNING</div>
<div>httpd Service: RUNNING</div>
<div>pki-tomcatd Service: RUNNING</div>
<div>smb Service: RUNNING</div>
<div>winbind Service: RUNNING</div>
<div>ipa-otpd Service: RUNNING</div>
<div>ipa-dnskeysyncd Service: RUNNING</div>
<div>ipa: INFO: The ipactl command was successful</div>
<div><br>
</div>
<div>kinit admin works as expected !</div>
<div><br>
</div>
<div><br>
</div>
<div><b><br>
</b></div>
<div><b>DNS konfiguration:</b></div>
<div><b>IPA-Side:</b></div>
<div><br>
</div>
<div>[<a href="mailto:root@ipa01" style="cursor: text;" target="_blank">root@ipa01</a> ~]# dig +short -t SRV _kerberos._udp.wop.domain.com</div>
<div>0 100 88 ipa02.wop.domain.com.</div>
<div>0 100 88 ipa01.wop.domain.com.</div>
<div><br>
</div>
<div><a href="mailto:root@ipa01" style="cursor: text;" target="_blank">root@ipa01</a> ~]# dig +short -t TXT _kerberos.wop.domain.com</div>
<div>"WOP.DOMAIN.COM"</div>
<div><br>
</div>
<div>[<a href="mailto:root@ipa01" style="cursor: text;" target="_blank">root@ipa01</a> ~]# dig +short -t SRV _kerberos._udp.dc._msdcs.wop.domain.com.</div>
<div>0 100 88 ipa02.wop.domain.com.</div>
<div>0 100 88 ipa01.wop.domain.com.</div>
<div><br>
</div>
<div>[<a href="mailto:root@ipa01" style="cursor: text;" target="_blank">root@ipa01</a> ~]# dig +short -t SRV _kerberos._tcp.dc._msdcs.wop.domain.com.</div>
<div>0 100 88 ipa01.wop.domain.com.</div>
<div>0 100 88 ipa02.wop.domain.com.</div>
<div><br>
</div>
<div><b>AD-Side:</b></div>
<div><br>
</div>
<div>C:\Users\demueller>nslookup</div>
<div>Standardserver: dc2.domain.com</div>
<div>Address: 192.168.3.9</div>
<div><br>
</div>
<div>> set type=SRV</div>
<div>> _kerberos._udp.wop.domain.com.</div>
<div>Server: dc2.domain.com</div>
<div>Address: 192.168.3.9</div>
<div><br>
</div>
<div>Nicht autorisierende Antwort:</div>
<div>_kerberos._udp.wop.domain.com SRV service location:</div>
<div> priority = 0</div>
<div> weight = 100</div>
<div> port = 88</div>
<div> svr hostname = ipa01.wop.domainc.om</div>
<div>_kerberos._udp.wop.rto.de SRV service location:</div>
<div> priority = 0</div>
<div> weight = 100</div>
<div> port = 88</div>
<div> svr hostname = ipa02.wop.domain.com</div>
<div><br>
</div>
<div>ipa01.wop.domain.com internet address = 192.168.11.75</div>
<div>ipa02.wop.domainc.om internet address = 192.168.11.106</div>
<div><br>
</div>
<div>DNS looks fine, firewall too.</div>
<div><br>
</div>
<div>Providing trust:ipa trust-add --type=ad rto.de --trust-secret --server=dc2.domain.com</div>
<div><br>
</div>
<div>As a Result:</div>
<div><br>
</div>
<div>[<a href="mailto:root@ipa01" target="_blank">root@ipa01</a> ~]# <b>ipa trustdomain-find domain.com</b></div>
<div> Domain name: domain.com</div>
<div> Domain NetBIOS name: DOMAIN (It should be DC2, right?)</div>
<div> Domain Security Identifier: S-1-5-21-746137067-2052111302-1801674531</div>
<div> Domain enabled: True</div>
<div>-------------------------------------</div>
<div><br>
</div>
<div><br>
</div>
<div><b>ipa trust-fetch-domain domain.com</b></div>
<div><br>
</div>
<div>Logging:</div>
<div><br>
</div>
<div>[Thu Nov 24 13:43:44.167918 2016] [:error] [pid 9123] ipa: INFO: [jsonserver_session]
<a href="file://admin@WOP.DOMAIN" target="_blank">admin@WOP.DOMAIN</a>.COM: ping(): SUCCESS</div>
<div>[Thu Nov 24 13:43:44.306718 2016] [:error] [pid 9124] ipa: INFO: [jsonserver_session]
<a href="file://admin@WOP.DOMAIN" target="_blank">admin@WOP.DOMAIN</a>.COM: trustdomain_find(u'domain.com', None, all=False, raw=False, version=u'2.156', pkey_only=False): SUCCESS</div>
<div>[Thu Nov 24 13:45:16.662862 2016] [:error] [pid 9123] ipa: INFO: 401 Unauthorized: Insufficient access: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Cannot contact any KDC for realm 'WOP.DOMAIN.COM)</div>
<div><br>
</div>
<div>I can't understand the problem.</div>
<div><br>
</div>
<div>On AD side we create a trust certifiacte as explained hear:</div>
<div><a href="http://www.freeipa.org/page/Active_Directory_trust_setup" target="_blank">http://www.freeipa.org/page/Active_Directory_trust_setup</a></div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
<div>
<hr align="left" size="2" noshade="" width="50%">
</div>
<br>-- <br>Manage your subscription for the Freeipa-users mailing list:<br>https://www.redhat.com/mailman/listinfo/freeipa-users<br>Go to http://freeipa.org for more info on the project</div></div><br></div></body></html>