[Freeipa-users] AD - IPA Trust Issues

Hello everyone. I hoped I could ask for a little assistance on an AD / IPA Trust. I've for a Windows 2008R2 domain. Response Type: LOGON_SAM_LOGON_RESPONSE_EX GUID: e**********************6497 Flags: Is a PDC: no Is a GC of the forest: yes Is an LDAP server: yes Supports DS: yes Is running a KDC: yes Is running time services: yes Is the closest DC: yes Is writable: yes Has a hardware clock: no Is a non-domain NC serviced by LDAP server: no Is NT6 DC that has some secrets: no Is NT6 DC that has all secrets: yes Runs Active Directory Web Services: yes Runs on Windows 2012 or later: no Forest: example.local Domain: example.local Domain Controller: CSAD1.example.local Pre-Win2k Domain: example Pre-Win2k Hostname: CSAD1 Server Site Name : Site1 Client Site Name : Site1 NT Version: 5 LMNT Token: ffff LM20 Token: ffff ----------------- IPA ipa-server-4.4.0-14.el7 Domain = lci.example.com ------------------ I start the process and DNS lookups are working. [root@ipa-001 samba]# !872 dig SRV _ldap._tcp.example.local ; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.3 <<>> SRV _ldap._tcp.example.local ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45828 ;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 5 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;_ldap._tcp.example.local. IN SRV ;; ANSWER SECTION: _ldap._tcp.example.local. 600 IN SRV 0 100 389 ac-ad4.example.local. _ldap._tcp.example.local. 600 IN SRV 0 100 389 csad2.example.local. _ldap._tcp.example.local. 600 IN SRV 0 100 389 csad1.example.local. _ldap._tcp.example.local. 600 IN SRV 0 100 389 ac-ad3.example.local. ;; ADDITIONAL SECTION: csad1.example.local. 3196 IN A 192.168.2.1 ac-ad4.example.local. 3196 IN A 192.168.2.4 ac-ad3.example.local. 3196 IN A 192.168.2.3 csad2.example.local. 3196 IN A 192.168.2.2 ;; Query time: 1 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Fri Jun 09 19:50:34 UTC 2017 ;; MSG SIZE rcvd: 290 [root@ipa-001 samba]# dig SRV _ldap._tcp.lci.example.local ; <<>> DiG 9.9.4-RedHat-9.9.4-38.el7_3.3 <<>> SRV _ldap._tcp.lci.example.local ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64288 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 3 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;_ldap._tcp.lci.example.local. IN SRV ;; ANSWER SECTION: _ldap._tcp.lci.example.local. 86400 IN CNAME _ldap._tcp.atl._locations.lci. example.local. _ldap._tcp.atl._locations.lci.example.local. 86400 IN SRV 0 5 389 ipa-001.lci.example.local. _ldap._tcp.atl._locations.lci.example.local. 86400 IN SRV 0 10 389 ipa-002.lci.example.local. ;; AUTHORITY SECTION: lci.example.local. 86400 IN NS ipa-002.lci.example.local. lci.example.local. 86400 IN NS ipa-001.lci.example.local. ;; ADDITIONAL SECTION: ipa-001.lci.example.local. 1200 IN A 192.168.1.11 ipa-002.lci.example.local. 1200 IN A 192.168.1.12 ;; Query time: 0 msec ;; SERVER: 127.0.0.1#53(127.0.0.1) ;; WHEN: Fri Jun 09 19:50:40 UTC 2017 ;; MSG SIZE rcvd: 272 [root@ipa-001 samba]# -------------- My bound `ldapsearch` and `kinit` on both domains domain work well. As I move onto testing the `trust-fetch-domains` area things go bad ( well start to show they are ). -------------- [root@ipa-001 samba]# ipa trust-fetch-domains example.local ------------------------------------------------------------ ---------------------------- List of trust domains successfully refreshed. Use trustdomain-find command to list them. ------------------------------------------------------------ ---------------------------- ---------------------------- Number of entries returned 0 ---------------------------- [root@ipa-001 samba]# ipa trustdomain-find example.LOCAL Domain name: example.local Domain NetBIOS name: example Domain Security Identifier: S-1-5-21-******-857828577-140568808 Domain enabled: True ---------------------------- Number of entries returned 1 ---------------------------- Of course any movement from there on fails. Using other posts I bumped up the logging and pulled out items that I believe assist in this matter. ---------- log.winbindd-dc-connect: check_negative_conn_cache returning result 0 for domain example.local server 192.168.2.3 log.winbindd-dc-connect: check_negative_conn_cache returning result -1073741823 for domain example.local server 192.168.2.2 log.winbindd-dc-connect: check_negative_conn_cache returning result -1073741823 for domain example.local server 192.168.2.4 log.winbindd-dc-connect: get_sorted_dc_list: attempting lookup for name example.local (sitename NULL) log.winbindd-dc-connect: saf_fetch: failed to find server for "example.local" domain log.winbindd-dc-connect: internal_resolve_name: looking up example.local#1c (sitename (null)) log.winbindd-dc-connect: name example.local#1C found. log.winbindd-dc-connect: check_negative_conn_cache returning result -1073741823 for domain example.local server 192.168.2.1 log.winbindd-dc-connect: Adding cache entry with key=[NEG_CONN_CACHE/example.local,192.168.2.3] and timeout=[Thu Jan 1 12:00:00 AM 1970 UTC] (-1497038264 seconds in the past) log.winbindd-dc-connect: check_negative_conn_cache returning result 0 for domain example.local server 192.168.2.3 log.winbindd-dc-connect: check_negative_conn_cache returning result -1073741823 for domain example.local server 192.168.2.2 log.winbindd-dc-connect: check_negative_conn_cache returning result -1073741823 for domain example.local server 192.168.2.4 log.winbindd-dc-connect: get_sorted_dc_list: attempting lookup for name example.local (sitename NULL) log.winbindd-dc-connect: saf_fetch: failed to find server for "example.local" domain log.winbindd-dc-connect: internal_resolve_name: looking up example.local#1c (sitename (null)) log.winbindd-dc-connect: name example.local#1C found. log.winbindd-dc-connect: check_negative_conn_cache returning result -1073741823 for domain example.local server 192.168.2.1 log.winbindd-dc-connect: Adding cache entry with key=[NEG_CONN_CACHE/example.local,192.168.2.3] and timeout=[Thu Jan 1 12:00:00 AM 1970 UTC] (-1497038340 seconds in the past) log.winbindd-dc-connect: check_negative_conn_cache returning result 0 for domain example.local server 192.168.2.3 log.winbindd-dc-connect: check_negative_conn_cache returning result -1073741823 for domain example.local server 192.168.2.2 log.winbindd-dc-connect: check_negative_conn_cache returning result -1073741823 for domain example.local server 192.168.2.4 log.winbindd-idmap: pdb_init_ipasam: support for pdb_enum_upn_suffixes enabled for domain lci.example.local ------------------- I see in the logs the timeouts however I thought they appeared to conflict with the ability to `net ads lookup`. Any assistance on this would be appreciated a great deal. Thank you so much for your time and looking at this.