<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div>
<div style="color: rgb(0, 0, 0);">Hi FreeIpa Community,</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">i'm actually new to the software and have some basic questions. We have linux users in in active directory. </div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">To be more flexible, we would like to install freeipa, import all users from ad and manage all the stuff like ssh, sudo etc. from ipa.</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">1. Do i need establish a trust first like mentioned here:</div>
<div style="color: rgb(0, 0, 0);"><a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Windows_Integration_Guide/creating-trusts.html#trust-one-two-way">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Windows_Integration_Guide/creating-trusts.html#trust-one-two-way</a></div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">2. Or can we just create a sync to import all "linux-users" from ad into ipa and manage them just like ipa-users:</div>
<div style="color: rgb(0, 0, 0);"><a href="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Windows_Integration_Guide/managing-sync-agmt.html">https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Windows_Integration_Guide/managing-sync-agmt.html</a></div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">3. ipa-replica-manage connect --winsync --binddn <span style="color: rgb(240, 240, 240); font-family: Menlo, Monaco, 'Courier New', monospace; font-size: 0.9em; line-height: inherit; orphans: 4; white-space: pre-wrap; widows: 4; background-color: rgb(51, 51, 51);">cn=administrator,cn=users,dc=example,dc=com
</span> --bindpw "***" --passsync "***" --cacert /root/dc1.crt dc1.example.com -v</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">getting an error:</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);"><font color="#008080">Traceback (most recent call last):</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#008080"> File "/usr/sbin/ipa-replica-manage", line 1607, in <module></font></div>
<div style="color: rgb(0, 0, 0);"><font color="#008080"> main(options, args)</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#008080"> File "/usr/sbin/ipa-replica-manage", line 1566, in main</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#008080"> add_link(realm, replica1, replica2, dirman_passwd, options)</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#008080"> File "/usr/sbin/ipa-replica-manage", line 1118, in add_link</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#008080"> if not ds.add_ca_cert(options.cacert):</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#008080"> File "/usr/lib/python2.7/site-packages/ipaserver/install/dsinstance.py", line 1018, in add_ca_cert</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#008080"> certdb.load_cacert(cacert_fname, 'C,,')</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#008080"> File "/usr/lib/python2.7/site-packages/ipaserver/install/certs.py", line 261, in load_cacert</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#008080"> (rdn, subject_dn) = get_cert_nickname(cert)</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#008080"> File "/usr/lib/python2.7/site-packages/ipaserver/install/certs.py", line 67, in get_cert_nickname</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#008080"> return (str(dn[0]), dn)</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#008080"> File "/usr/lib/python2.7/site-packages/ipapython/dn.py", line 1170, in __getitem__</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#008080"> return self._get_rdn(self.rdns[key])</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#008080">IndexError: list index out of range</font></div>
<div style="color: rgb(0, 0, 0);"><font color="#008080">Unexpected error: list index out of range</font></div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">[<a href="mailto:root@ipa01">root@ipa01</a> ~]# uname -r</div>
<div style="color: rgb(0, 0, 0);">3.10.0-327.el7.x86_64</div>
<div style="color: rgb(0, 0, 0);">[<a href="mailto:root@ipa01">root@ipa01</a> ~]# cat /etc/redhat-release </div>
<div style="color: rgb(0, 0, 0);">CentOS Linux release 7.3.1611 (Core)</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">We would appreciate any help,</div>
<div style="color: rgb(0, 0, 0);"><br>
</div>
<div style="color: rgb(0, 0, 0);">greets,</div>
<div style="color: rgb(0, 0, 0);">Denis</div>
</div>
</body>
</html>