<div dir="ltr">Hello,<div><br></div><div>To add to previous mail, I have noticed this:</div><div><br></div><div>I had two IPA, hydrogen and lithium. lithium died and will be resetting another soon after I find why the setup isn't redundant with one IPA. But this line seem to be a lead</div><div><br></div><div>Working:</div><div>ipa_server = _srv_, <a href="http://hydrogen.eng.example.com">hydrogen.eng.example.com</a><br></div><div><br></div><div>Failing:</div><div>ipa_server = _srv_, <a href="http://lithium.eng.example.com">lithium.eng.example.com</a><br></div><div><br></div><div>Have read on that format and seem fine from the reading. To add on that, DNS records seem to be fine too.</div><div><br></div><div><div><br></div><div>; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.47.rc1.el6_8.3 <<>> SRV _ldap._<a href="http://tcp.eng.example.com">tcp.eng.example.com</a></div><div>;; global options: +cmd</div><div>;; Got answer:</div><div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 34</div><div>;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 2, ADDITIONAL: 2</div><div><br></div><div>;; QUESTION SECTION:</div><div>;_ldap._<a href="http://tcp.eng.example.com">tcp.eng.example.com</a>. IN SRV</div><div><br></div><div>;; ANSWER SECTION:</div><div>_ldap._<a href="http://tcp.eng.example.com">tcp.eng.example.com</a>. 86400 IN SRV 0 100 389 <a href="http://hydrogen.eng.example.com">hydrogen.eng.example.com</a>.</div><div>_ldap._<a href="http://tcp.eng.example.com">tcp.eng.example.com</a>. 86400 IN SRV 0 100 389 <a href="http://lithium.eng.example.com">lithium.eng.example.com</a>.</div><div><br></div><div>;; AUTHORITY SECTION:</div><div><a href="http://eng.example.com">eng.example.com</a>. 86400 IN NS <a href="http://hydrogen.eng.example.com">hydrogen.eng.example.com</a>.</div><div><a href="http://eng.example.com">eng.example.com</a>. 86400 IN NS <a href="http://lithium.eng.example.com">lithium.eng.example.com</a>.</div><div><br></div><div>;; ADDITIONAL SECTION:</div><div><a href="http://lithium.eng.example.com">lithium.eng.example.com</a>. 1200 IN A 192.168.20.3</div><div><a href="http://hydrogen.eng.example.com">hydrogen.eng.example.com</a>. 1200 IN A 192.168.20.1</div><div><br></div><div>;; Query time: 1 msec</div><div>;; SERVER: 192.168.20.1#53(192.168.20.1)</div><div>;; WHEN: Tue Mar 14 18:32:44 2017</div><div>;; MSG SIZE rcvd: 200</div></div><div><br></div><div><br></div><div>What could I be missing?</div><div><br></div><div>Regards,</div><div>William</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 5 March 2017 at 14:59, William Muriithi <span dir="ltr"><<a href="mailto:william.muriithi@gmail.com" target="_blank">william.muriithi@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Jakub,<br>
<span class=""><br>
>><br>
>> It does look though like kerberos is not affected as all systems can<br>
>> authenticate fine, so looks like its autofs issue alone<br>
>><br>
>> This is the error I am noticing on the logs.<br>
>><br>
>> Mar 2 14:18:29 platinum automount[2887]: key "brad" not found in map source(s).<br>
>> Mar 2 14:19:18 platinum automount[2887]: bind_ldap_simple:<br>
>> lookup(ldap): Unable to bind to the LDAP server: (default), error<br>
>> Can't contact LDAP server<br>
>> Mar 2 14:19:21 platinum automount[2887]: bind_ldap_simple:<br>
>> lookup(ldap): Unable to bind to the LDAP server: (default), error<br>
>> Can't contact LDAP server<br>
><br>
</span>> I guess /etc/nsswitch.conf uses ldap for automount and not sssd?<br>
><br>
Actually no. We are using SSSD<br>
<br>
Just checked to confirm and looks like below:<br>
<br>
services: files sss<br>
netgroup: files sss<br>
publickey: nisplus<br>
automount: sss files<br>
aliases: files nisplus<br>
sudoers: files sss<br>
<br>
Regards,<br>
William<br>
******************************<wbr>*****<br>
</blockquote></div><br></div>