Ad integration

[Andrew Meyer]

Hello,I am working on setting up FreeIPA with AD integration and seem to be running into an issue.  Its possible that I am also doing something wrong.
I am setting it up to talk to MS Windows Server 2012r2.  Following directions on https://www.freeipa.org/page/Active_Directory_trust_setup%C2%A0
I have not edited the /etc/krb5.conf ( I figured that needed to happen on the client machines.) 
I am actually at this step:https://www.freeipa.org/page/Active_Directory_trust_setup#Create_external_an...

I am getting the following error:
[andrew.meyer@freeipa01 ~]$ sudo ipa group-add-member ad_admins_external --external 'MEYER-AD\Domain Admins'[member user]: [member group]:   Group name: ad_admins_external  Description: ad.meyer.local admins external map  External member: S-1-5-21-2117027177-2554619188-4034396183-512, S-1-5-21-2117027177-2554619188-4034396183-1106  Member users: andrew.meyer  Member groups: ad_admins  Member of groups: ad_admins, ipausers  Indirect Member groups: ad_admins_external  Failed members:     member user:     member group: MEYER-AD\Domain Admins: invalid 'trusted domain object': no trusted domain matched the specified flat name-------------------------Number of members added 0-------------------------[andrew.meyer@freeipa01 ~]$ 
What am I doing wrong?

[Alexander Bokovoy]

On ma, 22 heinä 2019, Andrew Meyer via FreeIPA-users wrote:
> Hello,                                                                       
> I am working on setting up FreeIPA with AD integration and seem to be        
> running into an issue.  Its possible that I am also doing something wrong.   
> I am setting it up to talk to MS Windows Server 2012r2.  Following           
> directions on https://www.freeipa.org/page/Active_Directory_trust_setup%C2%A0     
> I have not edited the /etc/krb5.conf ( I figured that needed to happen on    
> the client machines.)

Please use official documentation instead. The page above was written
quite a few years ago by test engineers to help themselves to get
through various test scenarios. You are better to use
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/htm...
> I am actually at this step:                                                  
> https://www.freeipa.org/page/Active_Directory_trust_setup#Create_external_an...
> I am getting the following error:                                            
> [andrew.meyer@freeipa01 ~]$ sudo ipa group-add-member ad_admins_external     
> --external 'MEYER-AD\Domain Admins'                                          
> [member user]:                                                               
> [member group]:                                                              
>   Group name: ad_admins_external                                             
>   Description: ad.meyer.local admins external map                            
>   External member: S-1-5-21-2117027177-2554619188-4034396183-512,            
> S-1-5-21-2117027177-2554619188-4034396183-1106                               
>   Member users: andrew.meyer                                                 
>   Member groups: ad_admins                                                   
>   Member of groups: ad_admins, ipausers                                      
>   Indirect Member groups: ad_admins_external                                 
>   Failed members:                                                            
>     member user:                                                             
>     member group: MEYER-AD\Domain Admins: invalid 'trusted domain object':   
> no trusted domain matched the specified flat name

This particular error message tells that there is no a trust to AD with
'MEYER-AD' as its NetBIOS name.

It might be that the trust wasn't established successfully, thus it is
not possible to use it to resolve users.

Start with 'ipa trust-find' output.

[Andrew Meyer]

Getting this:
[andrew.meyer@freeipa01 ~]$ sudo ipa trust-find ---------------1 trust matched---------------  Realm name: ad.meyer.local  Domain NetBIOS name: MEYERAD  Domain Security Identifier: S-1-5-21-1219070868-1303614073-2179474410  Trust type: Active Directory domain----------------------------Number of entries returned 1----------------------------[andrew.meyer@freeipa01 ~]$

On Monday, July 22, 2019, 10:26:29 AM CDT, Alexander Bokovoy  wrote:

On ma, 22 heinä 2019, Andrew Meyer via FreeIPA-users wrote:
> Hello,                                                                      
> I am working on setting up FreeIPA with AD integration and seem to be        
> running into an issue.  Its possible that I am also doing something wrong.  
> I am setting it up to talk to MS Windows Server 2012r2.  Following          
> directions on https://www.freeipa.org/page/Active_Directory_trust_setup%C2%A0     
> I have not edited the /etc/krb5.conf ( I figured that needed to happen on    
> the client machines.)

Please use official documentation instead. The page above was written
quite a few years ago by test engineers to help themselves to get
through various test scenarios. You are better to use
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/htm...
> I am actually at this step:                                                  
> https://www.freeipa.org/page/Active_Directory_trust_setup#Create_external_an...
> I am getting the following error:                                            
> [andrew.meyer@freeipa01 ~]$ sudo ipa group-add-member ad_admins_external    
> --external 'MEYER-AD\Domain Admins'                                          
> [member user]:                                                               
> [member group]:                                                             
>   Group name: ad_admins_external                                            
>   Description: ad.meyer.local admins external map                            
>   External member: S-1-5-21-2117027177-2554619188-4034396183-512,            
> S-1-5-21-2117027177-2554619188-4034396183-1106                              
>   Member users: andrew.meyer                                                
>   Member groups: ad_admins                                                  
>   Member of groups: ad_admins, ipausers                                      
>   Indirect Member groups: ad_admins_external                                
>   Failed members:                                                           
>     member user:                                                             
>     member group: MEYER-AD\Domain Admins: invalid 'trusted domain object':  
> no trusted domain matched the specified flat name

This particular error message tells that there is no a trust to AD with
'MEYER-AD' as its NetBIOS name.

It might be that the trust wasn't established successfully, thus it is
not possible to use it to resolve users.

Start with 'ipa trust-find' output.

[John Keates]

So the name is MEYERAD but you typed MEYER-AD.  Remove the dash from your earlier command and it should work.

John
> On 22 Jul 2019, at 17:48, Andrew Meyer via FreeIPA-users  wrote:
>
> Getting this:
> [andrew.meyer@freeipa01 ~]$ sudo ipa trust-find
> 1 trust matched
>
> Realm name: ad.meyer.local
>   Domain NetBIOS name: MEYERAD
>   Domain Security Identifier: S-1-5-21-1219070868-1303614073-2179474410
>   Trust type: Active Directory domain
> Number of entries returned 1
>
> [andrew.meyer@freeipa01 ~]$
>
> On Monday, July 22, 2019, 10:26:29 AM CDT, Alexander Bokovoy  wrote:
>
> On ma, 22 heinä 2019, Andrew Meyer via FreeIPA-users wrote:
> > Hello,                                                                      
> > I am working on setting up FreeIPA with AD integration and seem to be        
> > running into an issue.  Its possible that I am also doing something wrong.  
> > I am setting it up to talk to MS Windows Server 2012r2.  Following          
> > directions on https://www.freeipa.org/page/Active_Directory_trust_setup%C2%A0  https://www.freeipa.org/page/Active_Directory_trust_setup%C2%A0    
> > I have not edited the /etc/krb5.conf ( I figured that needed to happen on    
> > the client machines.)
>
> Please use official documentation instead. The page above was written
> quite a few years ago by test engineers to help themselves to get
> through various test scenarios. You are better to use
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/htm... https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html-single/windows_integration_guide/index
> > I am actually at this step:                                                  
> > https://www.freeipa.org/page/Active_Directory_trust_setup#Create_external_an... https://www.freeipa.org/page/Active_Directory_trust_setup#Create_external_and_POSIX_groups_for_trusted_domain_users
> > I am getting the following error:                                            
> > [andrew.meyer@freeipa01  ~]$ sudo ipa group-add-member ad_admins_external    
> > --external 'MEYER-AD\Domain Admins'                                          
> > [member user]:                                                               
> > [member group]:                                                             
> >  Group name: ad_admins_external                                            
> >  Description: ad.meyer.local admins external map                            
> >  External member: S-1-5-21-2117027177-2554619188-4034396183-512,            
> > S-1-5-21-2117027177-2554619188-4034396183-1106                              
> >  Member users: andrew.meyer                                                
> >  Member groups: ad_admins                                                  
> >  Member of groups: ad_admins, ipausers                                      
> >  Indirect Member groups: ad_admins_external                                
> >  Failed members:                                                           
> >    member user:                                                             
> >    member group: MEYER-AD\Domain Admins: invalid 'trusted domain object':  
> > no trusted domain matched the specified flat name
>
> This particular error message tells that there is no a trust to AD with
> 'MEYER-AD' as its NetBIOS name.
>
> It might be that the trust wasn't established successfully, thus it is
> not possible to use it to resolve users.
>
> Start with 'ipa trust-find' output.
>
> -- 
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering
> Red Hat Limited, Finland
>
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

[Alexander Bokovoy]

On ma, 22 heinä 2019, Andrew Meyer wrote:
> 0;47m   Getting this:                                                                
> [andrew.meyer@freeipa01 ~]$ sudo ipa trust-find
> 1 trust matched
>
> Realm name: ad.meyer.local                                                 
>   Domain NetBIOS name: MEYERAD                                               
>   Domain Security Identifier: S-1-5-21-1219070868-1303614073-2179474410      
>   Trust type: Active Directory domain
> Number of entries returned 1

So, you should be using 'MEYERAD\Domain Admins' then.

[Andrew Meyer]

Once this is done I should be able to do id user.name and get the Active Directory user correct?
    On Monday, July 22, 2019, 11:03:10 AM CDT, Alexander Bokovoy  wrote:

On ma, 22 heinä 2019, Andrew Meyer wrote:
> 0;47m  Getting this:                                                                
> [andrew.meyer@freeipa01 ~]$ sudo ipa trust-find                             
> ---------------                                                              
> 1 trust matched                                                              
> ---------------                                                              
>   Realm name: ad.meyer.local                                                
>   Domain NetBIOS name: MEYERAD                                              
>   Domain Security Identifier: S-1-5-21-1219070868-1303614073-2179474410      
>   Trust type: Active Directory domain                                        
> ----------------------------                                                
> Number of entries returned 1                                                
> ----------------------------

So, you should be using 'MEYERAD\Domain Admins' then.

[Alexander Bokovoy]

On ma, 22 heinä 2019, Andrew Meyer via FreeIPA-users wrote:
> Once this is done I should be able to do id user.name and get the Active Directory user correct?

Resolving users is unrelated to mapping groups.
You should be able to resolve users already.

[Andrew Meyer]

[andrew.meyer@freeipa01 ~]$ id james.kirkid: james.kirk: no such user[andrew.meyer@freeipa01 ~]$ id william.rikerid: william.riker: no such user[andrew.meyer@freeipa01 ~]$ 
Unless I neec to use ipa users-find command.
    On Monday, July 22, 2019, 11:47:12 AM CDT, Alexander Bokovoy  wrote:

On ma, 22 heinä 2019, Andrew Meyer via FreeIPA-users wrote:
> Once this is done I should be able to do id user.name and get the Active Directory user correct?

Resolving users is unrelated to mapping groups.
You should be able to resolve users already.

[François Cami]

On Mon, Jul 22, 2019 at 6:51 PM Andrew Meyer via FreeIPA-users
 wrote:
> [andrew.meyer@freeipa01 ~]$ id james.kirk
> id: james.kirk: no such user
> [andrew.meyer@freeipa01 ~]$ id william.riker
> id: william.riker: no such user
> [andrew.meyer@freeipa01 ~]$

Try "id user@DOMAIN" like this:
id [e-mail]
> Unless I neec to use ipa users-find command.
>
> On Monday, July 22, 2019, 11:47:12 AM CDT, Alexander Bokovoy  wrote:
>
> On ma, 22 heinä 2019, Andrew Meyer via FreeIPA-users wrote:
> > Once this is done I should be able to do id user.name and get the Active Directory user correct?
>
> Resolving users is unrelated to mapping groups.
> You should be able to resolve users already.
>
> --
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering
> Red Hat Limited, Finland
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

[Andrew Meyer]

Excellent thank you!
    On Monday, July 22, 2019, 12:01:53 PM CDT, François Cami  wrote:

On Mon, Jul 22, 2019 at 6:51 PM Andrew Meyer via FreeIPA-users
 wrote:
> [andrew.meyer@freeipa01 ~]$ id james.kirk
> id: james.kirk: no such user
> [andrew.meyer@freeipa01 ~]$ id william.riker
> id: william.riker: no such user
> [andrew.meyer@freeipa01 ~]$

Try "id user@DOMAIN" like this:
id [e-mail]
> Unless I neec to use ipa users-find command.
>
> On Monday, July 22, 2019, 11:47:12 AM CDT, Alexander Bokovoy  wrote:
>
> On ma, 22 heinä 2019, Andrew Meyer via FreeIPA-users wrote:
> > Once this is done I should be able to do id user.name and get the Active Directory user correct?
>
> Resolving users is unrelated to mapping groups.
> You should be able to resolve users already.
>
> --
> / Alexander Bokovoy
> Sr. Principal Software Engineer
> Security / Identity Management Engineering
> Red Hat Limited, Finland
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...

[John Keates]

What does the AD Trust list in IPA show for the AD domain you should be using? The same one? Or a different notation?

John
> On 22 Jul 2019, at 17:13, Andrew Meyer via FreeIPA-users  wrote:
>
> Hello,
> I am working on setting up FreeIPA with AD integration and seem to be running into an issue.  Its possible that I am also doing something wrong.
>
> I am setting it up to talk to MS Windows Server 2012r2.  Following directions on https://www.freeipa.org/page/Active_Directory_trust_setup
>
> I have not edited the /etc/krb5.conf ( I figured that needed to happen on the client machines.)
>
> I am actually at this step:
> https://www.freeipa.org/page/Active_Directory_trust_setup#Create_external_an...
>
> I am getting the following error:
>
> [andrew.meyer@freeipa01 ~]$ sudo ipa group-add-member ad_admins_external --external 'MEYER-AD\Domain Admins'
> [member user]: 
> [member group]: 
>   Group name: ad_admins_external
>   Description: ad.meyer.local admins external map
>   External member: S-1-5-21-2117027177-2554619188-4034396183-512, S-1-5-21-2117027177-2554619188-4034396183-1106
>   Member users: andrew.meyer
>   Member groups: ad_admins
>   Member of groups: ad_admins, ipausers
>   Indirect Member groups: ad_admins_external
>   Failed members: 
>     member user: 
>     member group: MEYER-AD\Domain Admins: invalid 'trusted domain object': no trusted domain matched the specified flat name
> Number of members added 0
>
> [andrew.meyer@freeipa01 ~]$
>
> What am I doing wrong?
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...