<div dir="ltr"><div>Excerpt from the httpd error_log on the FreeIPA replica:<br></div><div><br></div><div><div>[Thu Apr 13 11:17:44.072996 2017] [:error] [pid 28346] ipa: INFO: [jsonserver_kerb] <a href="mailto:admin@I.RDMEDIA.COM">admin@I.RDMEDIA.COM</a>: ping(): SUCCESS</div><div>[Thu Apr 13 11:17:50.708019 2017] [:error] [pid 28347] ipa: ERROR: non-public: RuntimeError: (-1073741811, 'Unexpected information received')</div><div>[Thu Apr 13 11:17:50.708121 2017] [:error] [pid 28347] Traceback (most recent call last):</div><div>[Thu Apr 13 11:17:50.708132 2017] [:error] [pid 28347] File "/usr/lib/python2.7/site-packages/ipaserver/rpcserver.py", line 366, in wsgi_execute</div><div>[Thu Apr 13 11:17:50.708140 2017] [:error] [pid 28347] result = command(*args, **options)</div><div>[Thu Apr 13 11:17:50.708147 2017] [:error] [pid 28347] File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 449, in __call__</div><div>[Thu Apr 13 11:17:50.708154 2017] [:error] [pid 28347] return self.__do_call(*args, **options)</div><div>[Thu Apr 13 11:17:50.708161 2017] [:error] [pid 28347] File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 477, in __do_call</div><div>[Thu Apr 13 11:17:50.708168 2017] [:error] [pid 28347] ret = self.run(*args, **options)</div><div>[Thu Apr 13 11:17:50.708213 2017] [:error] [pid 28347] File "/usr/lib/python2.7/site-packages/ipalib/frontend.py", line 799, in run</div><div>[Thu Apr 13 11:17:50.708223 2017] [:error] [pid 28347] return self.execute(*args, **options)</div><div>[Thu Apr 13 11:17:50.708229 2017] [:error] [pid 28347] File "/usr/lib/python2.7/site-packages/ipaserver/plugins/trust.py", line 739, in execute</div><div>[Thu Apr 13 11:17:50.708237 2017] [:error] [pid 28347] result = self.execute_ad(full_join, *keys, **options)</div><div>[Thu Apr 13 11:17:50.708244 2017] [:error] [pid 28347] File "/usr/lib/python2.7/site-packages/ipaserver/plugins/trust.py", line 989, in execute_ad</div><div>[Thu Apr 13 11:17:50.708258 2017] [:error] [pid 28347] trust_type</div><div>[Thu Apr 13 11:17:50.708265 2017] [:error] [pid 28347] File "/usr/lib/python2.7/site-packages/ipaserver/dcerpc.py", line 1683, in join_ad_full_credentials</div><div>[Thu Apr 13 11:17:50.708272 2017] [:error] [pid 28347] trust_type, trust_external)</div><div>[Thu Apr 13 11:17:50.708279 2017] [:error] [pid 28347] File "/usr/lib/python2.7/site-packages/ipaserver/dcerpc.py", line 1363, in establish_trust</div><div>[Thu Apr 13 11:17:50.708285 2017] [:error] [pid 28347] self.update_ftinfo(another_domain)</div><div>[Thu Apr 13 11:17:50.708292 2017] [:error] [pid 28347] File "/usr/lib/python2.7/site-packages/ipaserver/dcerpc.py", line 1252, in update_ftinfo</div><div>[Thu Apr 13 11:17:50.708299 2017] [:error] [pid 28347] ftinfo, 0)</div><div>[Thu Apr 13 11:17:50.708305 2017] [:error] [pid 28347] RuntimeError: (-1073741811, 'Unexpected information received')</div><div>[Thu Apr 13 11:17:50.709161 2017] [:error] [pid 28347] ipa: INFO: [jsonserver_kerb] <a href="mailto:admin@I.RDMEDIA.COM">admin@I.RDMEDIA.COM</a>: trust_add/1(u'<a href="http://clients.i.rdmedia.com">clients.i.rdmedia.com</a>', trust_type=u'ad', realm_admin=u'Administrator', realm_passwd=u'********', version=u'2.213'): RuntimeError</div></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 13 April 2017 at 18:08, Tiemen Ruiten <span dir="ltr"><<a href="mailto:t.ruiten@rdmedia.com" target="_blank">t.ruiten@rdmedia.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Of course:<div><br></div><div>FreeIPA versions:</div><div><div>[root@ipa-ams-01 samba]# rpm -qa | grep ipa</div><div>libipa_hbac-1.14.0-43.el7_3.<wbr>14.x86_64</div><div>sssd-ipa-1.14.0-43.el7_3.14.<wbr>x86_64</div><div>python2-ipaclient-4.4.0-14.<wbr>el7.centos.7.noarch</div><div>ipa-server-trust-ad-4.4.0-14.<wbr>el7.centos.7.x86_64</div><div>ipa-client-common-4.4.0-14.<wbr>el7.centos.7.noarch</div><div>python-iniparse-0.4-9.el7.<wbr>noarch</div><div>python-libipa_hbac-1.14.0-43.<wbr>el7_3.14.x86_64</div><div>python2-ipalib-4.4.0-14.el7.<wbr>centos.7.noarch</div><div>ipa-admintools-4.4.0-14.el7.<wbr>centos.7.noarch</div><div>ipa-server-common-4.4.0-14.<wbr>el7.centos.7.noarch</div><div>ipa-server-4.4.0-14.el7.<wbr>centos.7.x86_64</div><div>ipa-server-dns-4.4.0-14.el7.<wbr>centos.7.noarch</div><div>python-ipaddress-1.0.16-2.el7.<wbr>noarch</div><div>ipa-client-4.4.0-14.el7.<wbr>centos.7.x86_64</div><div>python2-ipaserver-4.4.0-14.<wbr>el7.centos.7.noarch</div><div>ipa-common-4.4.0-14.el7.<wbr>centos.7.noarch</div></div><div><br></div><div>Samba AD DC versions:<br></div><div>Also CentOS 7, Samba 4.6.2, built from source, configure with one option: --with-systemd</div><div><br></div><div><div>FreeIPA controls <a href="http://i.rdmedia.com" target="_blank">i.rdmedia.com</a>, <a href="http://prod.ams.i.rdmedia.com" target="_blank">prod.ams.i.rdmedia.com</a>, <a href="http://test.ams.i.rdmedia.com" target="_blank">test.ams.i.rdmedia.com</a> and <a href="http://prod.nyc.i.rdmedia.com" target="_blank">prod.nyc.i.rdmedia.com</a>.</div><div>AD controls only <a href="http://clients.i.rdmedia.com" target="_blank">clients.i.rdmedia.com</a> and forwards all other DNS queries to ipa-ams-01.</div></div><div><br></div><div>Samba uses the BIND9_DLZ backend for DNS. <br></div><div><br></div><div>Regarding the commands run: After provisioning the AD domain, I followed <a href="https://www.freeipa.org/page/Active_Directory_trust_setup" target="_blank">this</a> guide, except I set up the global forwarder in /etc/named.conf manually. </div><div><br></div><div>I got the <span style="color:rgb(0,0,0);font-size:12.8px">"ipa: ERROR an internal error has occurred" after running:</span></div><div><span style="color:rgb(0,0,0);font-size:12.8px"><br></span></div><div><font color="#000000"><span style="font-size:12.8px">ipa trust-add --type=ad <a href="http://clients.i.rdmedia.com" target="_blank">clients.i.rdmedia.com</a> --admin Administrator --password</span></font><br></div></div><div class="gmail_extra"><div><div class="h5"><br><div class="gmail_quote">On 13 April 2017 at 17:09, Alexander Bokovoy <span dir="ltr"><<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On to, 13 huhti 2017, Tiemen Ruiten wrote:<br> </span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span> Apologies, now with proper subject.<br> <br> On 13 April 2017 at 16:49, Tiemen Ruiten <<a href="mailto:t.ruiten@rdmedia.com" target="_blank">t.ruiten@rdmedia.com</a>> wrote:<br> <br> </span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span> Hello!<br> <br> As I understand from this<br></span> <<a href="https://www.redhat.com/archives/freeipa-users/2016-October/msg00147.html" rel="noreferrer" target="_blank">https://www.redhat.com/archiv<wbr>es/freeipa-users/2016-October/<wbr>msg00147.html</a>> thread,<div><div class="m_-284299490874781179h5"><br> it should be possible to setup a trust between FreeIPA and Samba4. My AD<br> domain is <a href="http://clients.i.rdmedia.com" rel="noreferrer" target="_blank">clients.i.rdmedia.com</a>, it's a subdomain of my FreeIPA domain,<br> <a href="http://i.rdmedia.com" rel="noreferrer" target="_blank">i.rdmedia.com</a>. Therefore I added a global forwarder on the Samba AD DC to<br> one of the FreeIPA replica's and lookup of SRV records in both domains<br> appears to work.<br> <br> However when I try to add the trust I get "ipa: ERROR an internal error<br> has occurred". I ran the trust-add command with full debug logging as<br> described on <a href="https://www.freeipa.org/page/Active_Directory_trust_setup#" rel="noreferrer" target="_blank">https://www.freeipa.org/page/A<wbr>ctive_Directory_trust_setup#</a><br> Debugging_trust, so I can provide these logs privately upon request.<br> <br> I suspect some DNS-issue, as right after I try to setup the trust, dynamic<br> updates stop working on the AD Domain Controller with this error:<br> <br> tkey query failed: GSSAPI error: Major = Unspecified GSS failure. Minor<br> code may provide more information, Minor = Server DNS/fluorine.clients.i.<br> <a href="mailto:rdmedia.com@I.RDMEDIA.COM" target="_blank">rdmedia.com@I.RDMEDIA.COM</a> not found in Kerberos database.<br> Failed nsupdate: 1<br> update(nsupdate): SRV _ldap._tcp.Default-First-Site-<wbr>Name._<br> <a href="http://sites.ForestDnsZones.clients.i.rdmedia.com" rel="noreferrer" target="_blank">sites.ForestDnsZones.clients.i<wbr>.rdmedia.com</a> <a href="http://fluorine.clients.i.rdmedia.com" rel="noreferrer" target="_blank">fluorine.clients.i.rdmedia.com</a><br> 389<br> Calling nsupdate for SRV _ldap._tcp.Default-First-Site-<wbr>Name._<br> <a href="http://sites.ForestDnsZones.clients.i.rdmedia.com" rel="noreferrer" target="_blank">sites.ForestDnsZones.clients.i<wbr>.rdmedia.com</a> <a href="http://fluorine.clients.i.rdmedia.com" rel="noreferrer" target="_blank">fluorine.clients.i.rdmedia.com</a><br> 389 (add)<br> Outgoing update query:<br> ;; ->>HEADER<<- opcode: UPDATE, status: NOERROR, id: 0<br> ;; flags:; ZONE: 0, PREREQ: 0, UPDATE: 0, ADDITIONAL: 0<br> ;; UPDATE SECTION:<br> _ldap._tcp.Default-First-Site-<wbr>Name._sites.ForestDnsZones.<br> <a href="http://clients.i.rdmedia.com" rel="noreferrer" target="_blank">clients.i.rdmedia.com</a>. 900 IN SRV 0 100 389 <a href="http://fluorine.clients.i.rdmedia.com" rel="noreferrer" target="_blank">fluorine.clients.i.rdmedia.com</a><br> .<br> <br> Many thanks in advance for your assistance.<br> </div></div></blockquote></blockquote> It would help if you would provide more details on your setup. The above<br> doesn't give a clue on:<br> - what are FreeIPA and Samba AD DC versions<br> - on what OS versions they run, correspondingly<br> - what DNS zones each of them control<br> - what commands did you run<span class="m_-284299490874781179HOEnZb"><font color="#888888"><br> <br> -- <br> / Alexander Bokovoy<br> </font></span></blockquote></div><br><br clear="all"><div><br></div></div></div><span class="">-- <br><div class="m_-284299490874781179gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">Tiemen Ruiten<br>Systems Engineer<br>R&D Media<br></div></div> </span></div> </blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">Tiemen Ruiten<br>Systems Engineer<br>R&D Media<br></div></div> </div>