Unable to create AD trust

[Jeremy Tourville]

Hello
I am running CentOS 7.9
FreeIPA 4.6.8
Installed with integrated DNS and CA
A replica will be installed after the trust is established with the AD domain.

When trying to create a trust with AD i get the following error message (it seems to be somewhat random but goes back and forth between these two)
Fetching domains from trusted forest failed 
OR
ipa: ERROR: cannot connect to 'https://<server>/ipa/session/json': Gateway Timeout

I have done the following to troubleshoot:

- disable Selinux, which makes no difference

- check firewall ports.  for your reference I have the following defined
  services: freeipa-ldap, freeiipa-ldaps, http, https, kerberos, ntp, dns, ssh
  ports: 749/tcp, 7389/tcp, 8005/tcp, 8009/tcp

- check DNS,  it all verifies properly according to 5.2.1.2  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/htm...

- enabled debugging per https://www.freeipa.org/page/Active_Directory_trust_setup#Establish_and_veri...

- disabled DNSSEC per https://access.redhat.com/solutions/2263991

I do see something of interest in the error_log but I am not sure if this is the problem.

wsgi:error Timeout when reading response headers from daemon process 'ipa': /usr/share/ipa/wsgi.py
ipa: ERROR: Failed to call com.redhat.idm.trust.fetch_domains helper. DBus exception is org.freedesktop.DBus.Error.NoReply: Did not receive a reply.  Possible causes include: the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken.
ipa: ERROR: Helper fetch_domain was called for forest <forest_name_here>, return code is 2

Any assistance you can provide is appreciated!

[Jeremy Tourville]

I think I got a little further in troubleshooting this after looking at  /var/log/httpd/error_log

I reviewed the Operations performed from an IdM trust controller towards AD domain controllers in table 6.7 from https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/htm...

I can see the CLDAP  transaction and it seems like it is returning data.
finddcs: performing CLDAP query on 192.168.105.15
then a few lines down in the log I see a bunch of data such as forest name, domain name, server_site, client_site, pdc_name etc.

I *think* it might be stuck at the next step

Operation                                                          Protocol              Purpose 
Requests to TCP/TCP6 ports 389 and 3268     LDAP                 To query AD user and group information
on an AD DC

Assuming this is correct.... how do you troubleshoot?

[Florence Blanc-Renaud]

Hi,

you can follow the debugging guidelines from
https://www.freeipa.org/page/Active_Directory_trust_setup#Debugging_trust.
The *ipa trust-add* logs will be visible in /var/log/httpd/error_log and in
the /var/log/samba directory.

flo

On Wed, Mar 30, 2022 at 7:17 PM Jeremy Tourville via FreeIPA-users <
[e-mail]> wrote:
> I think I got a little further in troubleshooting this after looking at
> /var/log/httpd/error_log
>
> I reviewed the Operations performed from an IdM trust controller towards
> AD domain controllers in table 6.7 from
> https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/htm...
>
> I can see the CLDAP  transaction and it seems like it is returning data.
> finddcs: performing CLDAP query on 192.168.105.15
> then a few lines down in the log I see a bunch of data such as forest
> name, domain name, server_site, client_site, pdc_name etc.
>
> I *think* it might be stuck at the next step
>
> Operation
> Protocol              Purpose
> Requests to TCP/TCP6 ports 389 and 3268     LDAP                 To query
> AD user and group information
> on an AD DC
>
> Assuming this is correct.... how do you troubleshoot?
> _______________________________________________
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam on the list, report it:
> https://pagure.io/fedora-infrastructure

[Jeremy Tourville]

Yes, already did that as part of my troubleshooting.  See my 1st post.  I have the logs but correctly interpreting them is a different matter.  I am hoping the experts can assist with that.