Hi all, I set up an instance of FreeIPA server and established trust with AD domain. I configured AD users and they can successfully log in to the web UI. Then, I set up a replica. Although the trust is visible for that instance both in the web UI and CLI, AD users cannot log in to it, nor can I execute su - for them. Upon unsuccessful login I get this error message from web UI: Runtime error Web UI got in unrecoverable state during "profile" phase. Technical details: Cannot read property 'cn' of undefined TypeError: Cannot read property 'cn' of undefined at Object.update_logged_in (https://idm2.ipa.domain.com/ipa/ui/js/freeipa/app.js?40503:1:18183) at Object.choose_profile (https://idm2.ipa.domain.com/ipa/ui/js/freeipa/app.js?40503:1:16656) at Object.<anonymous> (https://idm2.ipa.domain.com/ipa/ui/js/freeipa/app.js?40503:1:1190) at https://idm2.ipa.domain.com/ipa/ui/js/freeipa/app.js?40503:1:3478 at Object.forEach (https://idm2.ipa.domain.com/ipa/ui/js/dojo/dojo.js?v=40503:1:29752) at Object._run_phase (https://idm2.ipa.domain.com/ipa/ui/js/freeipa/app.js?40503:1:3442) at Object.next_phase (https://idm2.ipa.domain.com/ipa/ui/js/freeipa/app.js?40503:1:3904) at Object.<anonymous> (https://idm2.ipa.domain.com/ipa/ui/js/freeipa/app.js?40503:1:3631) at c (https://idm2.ipa.domain.com/ipa/ui/js/dojo/dojo.js?v=40503:1:60960) at Object.then.t.then (https://idm2.ipa.domain.com/ipa/ui/js/dojo/dojo.js?v=40503:1:62246) When I try to verify trust on the replica server, it behaves exactly as described in the documentation: [root@idm2 ~]# kinit testuser(a)domain.com Password for testuser(a)domain.com: [root@idm2 ~]# kvno -S host idm2.ipa.domain.com host/idm2.ipa.domain.com(a)IPA.DOMAIN.COM: kvno = 1 [root@idm2 ~]# klist Ticket cache: KEYRING:persistent:0:krb_ccache_kwhpOWN Default principal: testuser(a)DOMAIN.COM Valid starting Expires Service principal 10/19/2017 08:35:05 10/19/2017 18:34:55 host/idm2.ipa.domain.com(a)IPA.DOMAIN.COM renew until 10/20/2017 08:34:49 10/19/2017 08:35:05 10/19/2017 18:34:55 krbtgt/IPA.DOMAIN.COM.COM(a)DOMAIN.COM renew until 10/20/2017 08:34:49 10/19/2017 08:34:55 10/19/2017 18:34:55 krbtgt/DOMAIN.COM(a)DOMAIN.COM renew until 10/20/2017 08:34:49 What's more, FreeIPA can't seem to find testuser for idm2 host: [root@idm2 ~]# su - testuser(a)domain.com su: user testuser(a)domain.com does not exist Whereas this works for idm1 - primary FreeIPA server. Can you please advise on how to solve it? Many thanks, Bart