IPA <-> Samba AD trust issue

[Yuri Moens]

Hi

I'm currently trying to setup a trust between IPA and Samba AD but I keep
running into some issues.

IPA is running on CentOS 7
VERSION: 4.4.0, API_VERSION: 2.213
ipa01.cloud.ymo.lab, Netbios CLOUD, domain cloud.ymo.lab

Samba is running on CentOS7
Version 4.6.6
dc01.win.ymo.lab, Netbios WIN, domain win.ymo.lab

Both are fresh installs. Samba is running Bind DLZ as DNS backend. DNS
forwarding is working correctly.

[root@ipa01 ~]# dig +short srv _ldap._tcp.{cloud,win}.ymo.lab
0 100 389 ipa01.cloud.ymo.lab.
0 100 389 dc01.win.ymo.lab.
[root@ipa01 ~]# dig +short {cloud,win}.ymo.lab
10.0.0.195
10.0.0.196

[root@dc01 bin]# dig +short srv _ldap._tcp.{cloud,win}.ymo.lab
0 100 389 ipa01.cloud.ymo.lab.
0 100 389 dc01.win.ymo.lab.
[root@dc01 bin]# dig +short {cloud,win}.ymo.lab
10.0.0.195
10.0.0.196

I'm currently stuck on adding the trust:

[root@ipa01 ~]# ipa trust-add --type=ad win.ymo.lab --admin Administrator
--password --two-way=true
Active Directory domain administrator's password:
ipa: ERROR: CIFS server communication error: code "1315", message
"WERR_INVALID_ACCOUNT_NAME" (both may be "None")

I've attached the /var/log/httpd/error_log on the IPA side and the output
of Samba running with debug level 7.

Does anyone know how I can get past this?

Thanks
Yuri

[Alexander Bokovoy]

On pe, 04 elo 2017, Yuri Moens via FreeIPA-users wrote:
> Hi
>
> I'm currently trying to setup a trust between IPA and Samba AD but I keep
> running into some issues.
>
> IPA is running on CentOS 7
> VERSION: 4.4.0, API_VERSION: 2.213
> ipa01.cloud.ymo.lab, Netbios CLOUD, domain cloud.ymo.lab
>
> Samba is running on CentOS7
> Version 4.6.6
> dc01.win.ymo.lab, Netbios WIN, domain win.ymo.lab
>
> Both are fresh installs. Samba is running Bind DLZ as DNS backend. DNS
> forwarding is working correctly.
>
> [root@ipa01 ~]# dig +short srv _ldap._tcp.{cloud,win}.ymo.lab
> 0 100 389 ipa01.cloud.ymo.lab.
> 0 100 389 dc01.win.ymo.lab.
> [root@ipa01 ~]# dig +short {cloud,win}.ymo.lab
> 10.0.0.195
> 10.0.0.196
>
> [root@dc01 bin]# dig +short srv _ldap._tcp.{cloud,win}.ymo.lab
> 0 100 389 ipa01.cloud.ymo.lab.
> 0 100 389 dc01.win.ymo.lab.
> [root@dc01 bin]# dig +short {cloud,win}.ymo.lab
> 10.0.0.195
> 10.0.0.196
>
> I'm currently stuck on adding the trust:
>
> [root@ipa01 ~]# ipa trust-add --type=ad win.ymo.lab --admin Administrator
> --password --two-way=true
> Active Directory domain administrator's password:
> ipa: ERROR: CIFS server communication error: code "1315", message
> "WERR_INVALID_ACCOUNT_NAME" (both may be "None")
>
> I've attached the /var/log/httpd/error_log on the IPA side and the output
> of Samba running with debug level 7.
>
> Does anyone know how I can get past this? 
There are currently known bugs in Samba AD
in using wrong salt for TDO
account. At least for Samba 4.7.0 release candidates one can establish
trust but it will fail to work.

Your issue looks a bit different though. Add 
[global]
  log level = 100

to /usr/share/ipa/smb.conf.empty and re-try 'ipa trust-add ..'

In /var/log/httpd/error_log you'll get debug log of what IPA side sees
when talking to AD DCs and to a local smbd instance. Show those logs.

-- 
/ Alexander Bokovoy

[Yuri Moens]

The previous error_log I attached was already created with log level = 100.
I've tried to run the command again and attached the log file again but it
seems to be pretty much the same.

On Fri, Aug 4, 2017 at 4:55 PM Alexander Bokovoy <abokovoy(a)redhat.com&gt;
wrote:

>  On pe, 04 elo 2017, Yuri Moens via FreeIPA-users wrote:
>  >Hi
>  >
>  >I'm currently trying to setup a trust between IPA and Samba AD but I keep
>  >running into some issues.
>  >
>  >IPA is running on CentOS 7
>  >VERSION: 4.4.0, API_VERSION: 2.213
>  >ipa01.cloud.ymo.lab, Netbios CLOUD, domain cloud.ymo.lab
>  >
>  >Samba is running on CentOS7
>  >Version 4.6.6
>  >dc01.win.ymo.lab, Netbios WIN, domain win.ymo.lab
>  >
>  >Both are fresh installs. Samba is running Bind DLZ as DNS backend. DNS
>  >forwarding is working correctly.
>  >
>  >[root@ipa01 ~]# dig +short srv _ldap._tcp.{cloud,win}.ymo.lab
>  >0 100 389 ipa01.cloud.ymo.lab.
>  >0 100 389 dc01.win.ymo.lab.
>  >[root@ipa01 ~]# dig +short {cloud,win}.ymo.lab
>  >10.0.0.195
>  >10.0.0.196
>  >
>  >[root@dc01 bin]# dig +short srv _ldap._tcp.{cloud,win}.ymo.lab
>  >0 100 389 ipa01.cloud.ymo.lab.
>  >0 100 389 dc01.win.ymo.lab.
>  >[root@dc01 bin]# dig +short {cloud,win}.ymo.lab
>  >10.0.0.195
>  >10.0.0.196
>  >
>  >I'm currently stuck on adding the trust:
>  >
>  >[root@ipa01 ~]# ipa trust-add --type=ad win.ymo.lab --admin Administrator
>  >--password --two-way=true
>  >Active Directory domain administrator's password:
>  >ipa: ERROR: CIFS server communication error: code "1315", message
>  >"WERR_INVALID_ACCOUNT_NAME" (both may be "None")
>  >
>  >I've attached the /var/log/httpd/error_log on the IPA side and the output
>  >of Samba running with debug level 7.
>  >
>  >Does anyone know how I can get past this?
>  There are currently known bugs in Samba AD in using wrong salt for TDO
>  account. At least for Samba 4.7.0 release candidates one can establish
>  trust but it will fail to work.
>
>  Your issue looks a bit different though. Add
>  [global]
>    log level = 100
>
>  to /usr/share/ipa/smb.conf.empty and re-try 'ipa trust-add ..'
>
>  In /var/log/httpd/error_log you'll get debug log of what IPA side sees
>  when talking to AD DCs and to a local smbd instance. Show those logs.
>
>  --
>  / Alexander Bokovoy
>

[Alexander Bokovoy]

On ma, 07 elo 2017, Yuri Moens via FreeIPA-users wrote:
> The previous error_log I attached was already created with log level =
> 100.
> I've tried to run the command again and attached the log file again but it
> seems to be pretty much the same. 
I see in the logs that it fails at the
verification step. This problem
is not reproducible to me in Samba 4.7 release candidates, so I consider
it is solved on the Samba side. However, even with Samba 4.7 release
candidate versions, there are known bugs that prevent trust to Samba AD
fully working which I talked about before.

I'm coming back from vacation next week and intend to look at the
remaining issues before Samba 4.7.0 release.


-- 
/ Alexander Bokovoy