Installing trust between IdM and AD Red Hat Enterprise Linux 9 Managing a cross-forest trust between an IdM and AD domain Red Hat Customer Content Services

Commands:
C:\> gpupdate /force /target:computer
update-crypto-policies --set LEGACY:AD-SUPPORT-LEGACY Setting system policy to LEGACY:AD-SUPPORT-LEGACY Note: System-wide crypto policies are applied on application start-up. It is recommended to restart the system for the change of policies to fully take place.
ipa dns-update-system-records --dry-run
IPA DNS records: _kerberos-master._tcp.idm.example.com. 86400 IN SRV 0 100 88 server.idm.example.com. _kerberos-master._udp.idm.example.com. 86400 IN SRV 0 100 88 server.idm.example.com. _kerberos._tcp.idm.example.com. 86400 IN SRV 0 100 88 server.idm.example.com. _kerberos._tcp.idm.example.com. 86400 IN SRV 0 100 88 server.idm.example.com. _kerberos.idm.example.com. 86400 IN TXT "IDM.EXAMPLE.COM" _kpasswd._tcp.idm.example.com. 86400 IN SRV 0 100 464 server.idm.example.com. _kpasswd._udp.idm.example.com. 86400 IN SRV 0 100 464 server.idm.example.com. _ldap._tcp.idm.example.com. 86400 IN SRV 0 100 389 server.idm.example.com. _ipa-ca.idm.example.com. 86400 IN A 192.168.122.2
dnssec-enable no; dnssec-validation no;
systemctl restart named-pkcs11
nslookup ad.example.com Server: 192.168.122.2 Address: 192.168.122.2#53 No-authoritative answer: Name: ad.example.com Address: 192.168.122.3
ipa dnsforwardzone-add ad.example.com --forwarder= 192.168.122.3 --forward-policy=first
named-pkcs11[2572]: no valid DS resolving 'host.ad.example.com/A/IN': 192.168.100.25#53
dnssec-enable no; dnssec-validation no;
systemctl restart named-pkcs11
nslookup ad.example.com Server: 192.168.122.2 Address: 192.168.122.2#53 No-authoritative answer: Name: ad.example.com Address: 192.168.122.3
dig +short -t SRV _kerberos._udp.idm.example.com. 0 100 88 server.idm.example.com. dig +short -t SRV _ldap._tcp.idm.example.com. 0 100 389 server.idm.example.com.
dig +short -t TXT _kerberos.idm.example.com. "IDM.EXAMPLE.COM"
[admin@server ~]USD ipa dns-update-system-records
[admin@server ~]USD ipa dns-update-system-records --dry-run --out dns_records_file.nsupdate
dig +short -t SRV _kerberos._tcp.dc._msdcs.ad.example.com. 0 100 88 addc1.ad.example.com. dig +short -t SRV _ldap._tcp.dc._msdcs.ad.example.com. 0 100 389 addc1.ad.example.com.
ipa-client-install --domain=idm.example.com
.ad.example.com = IDM.EXAMPLE.COM ad.example.com = IDM.EXAMPLE.COM
idm-client.ad.example.com = IDM.EXAMPLE.COM
ipa-getcert request -r -f /etc/httpd/alias/server.crt -k /etc/httpd/alias/server.key -N CN=ipa-client.ad.example.com -D ipa-client.ad.example.com -K host/idm-client.ad.example.com@IDM.EXAMPLE.COM -U id-kp-serverAuth
ignore_acceptor_hostname = true
ipa host-add idm-client.ad.example.com --force
ipa host-add-managedby idm-client.ad.example.com --hosts=idm-client.idm.example.com
ipa-getcert request -r -f /etc/httpd/alias/server.crt -k /etc/httpd/alias/server.key -N CN=`hostname --fqdn` -D `hostname --fqdn` -D idm-client.ad.example.com -K host/idm-client.idm.example.com@IDM.EXAMPLE.COM -U id-kp-serverAuth
dnf install ipa-server-trust-ad samba-client
kinit admin
ipa-adtrust-install
WARNING: The smb.conf already exists. Running ipa-adtrust-install will break your existing Samba configuration. Do you wish to continue? [no]: yes
Do you want to enable support for trusted domains in Schema Compatibility plugin? This will allow clients older than SSSD 1.9 and non-Linux clients to work with trusted users. Enable trusted domains support in slapi-nis? [no]: yes
Do you want to run the ipa-sidgen task? [no]: yes
net conf setparm global 'rpc server dynamic port range' 55000-65000 firewall-cmd --add-port=55000-65000/tcp firewall-cmd --runtime-to-permanent
ipactl restart
smbclient -L ipaserver.idm.example.com -U user_name --use-kerberos=required lp_load_ex: changing to config backend registry Sharename Type Comment --------- ---- ------- IPCUSD IPC IPC Service (Samba 4.15.2)
ipa trust-add --type=ad ad.example.com --admin <ad_admin_username> --password --range-type=ipa-ad-trust
ipa trust-add --type=ad ad.example.com --admin <ad_admin_username> --password --range-type=ipa-ad-trust-posix
cd ~/ MyPlaybooks /
--- - name: Playbook to create a trust hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: ensure the trust is present ipatrust: ipaadmin_password: "{{ ipaadmin_password }}" realm: ad.example.com admin: Administrator password: secret_password state: present
--- - name: Playbook to create a trust hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: ensure the trust is present ipatrust: ipaadmin_password: "{{ ipaadmin_password }}" realm: ad.example.com admin: Administrator password: secret_password range_type: ipa-ad-trust-posix state: present
--- - name: Playbook to create a trust hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: ensure the trust is present ipatrust: ipaadmin_password: "{{ ipaadmin_password }}" realm: ad.example.com admin: Administrator password: secret_password state: present
ansible-playbook --vault-password-file=password_file -v -i inventory add-trust.yml
kinit user@AD.EXAMPLE.COM
kvno -S host server.idm.example.com
klist Ticket cache: KEYRING:persistent:0:krb_ccache_hRtox00 Default principal: user@AD.EXAMPLE.COM Valid starting Expires Service principal 03.05.2016 18:31:06 04.05.2016 04:31:01 host/server.idm.example.com@IDM.EXAMPLE.COM renew until 04.05.2016 18:31:00 03.05.2016 18:31:06 04.05.2016 04:31:01 krbtgt/IDM.EXAMPLE.COM@AD.EXAMPLE.COM renew until 04.05.2016 18:31:00 03.05.2016 18:31:01 04.05.2016 04:31:01 krbtgt/AD.EXAMPLE.COM@AD.EXAMPLE.COM renew until 04.05.2016 18:31:00
dig +short -t SRV _kerberos._udp.dc._msdcs.idm.example.com. 0 100 88 server.idm.example.com. dig +short -t SRV _ldap._tcp.dc._msdcs.idm.example.com. 0 100 389 server.idm.example.com.
dig +short -t SRV _kerberos._tcp.dc._msdcs.ad.example.com. 0 100 88 addc1.ad.example.com. dig +short -t SRV _ldap._tcp.dc._msdcs.ad.example.com. 0 100 389 addc1.ad.example.com.
C:\>nslookup.exe > set type=SRV
> _kerberos._udp.idm.example.com. _kerberos._udp.idm.example.com. SRV service location: priority = 0 weight = 100 port = 88 svr hostname = server.idm.example.com > _ldap._tcp.idm.example.com _ldap._tcp.idm.example.com SRV service location: priority = 0 weight = 100 port = 389 svr hostname = server.idm.example.com
C:\>nslookup.exe > set type=TXT > _kerberos.idm.example.com. _kerberos.idm.example.com. text = "IDM.EXAMPLE.COM"
C:\>nslookup.exe > set type=SRV > _kerberos._udp.dc._msdcs.idm.example.com. _kerberos._udp.dc._msdcs.idm.example.com. SRV service location: priority = 0 weight = 100 port = 88 svr hostname = server.idm.example.com > _ldap._tcp.dc._msdcs.idm.example.com. _ldap._tcp.dc._msdcs.idm.example.com. SRV service location: priority = 0 weight = 100 port = 389 svr hostname = server.idm.example.com
C:\>nslookup.exe > set type=SRV
> _kerberos._udp.dc._msdcs.ad.example.com. _kerberos._udp.dc._msdcs.ad.example.com. SRV service location: priority = 0 weight = 100 port = 88 svr hostname = addc1.ad.example.com > _ldap._tcp.dc._msdcs.ad.example.com. _ldap._tcp.dc._msdcs.ad.example.com. SRV service location: priority = 0 weight = 100 port = 389 svr hostname = addc1.ad.example.com
ipa-adtrust-install --add-agents
ipactl restart
sssctl cache-remove
ipa server-show new_replica.idm.example.com Enabled server roles: CA server, NTP server, AD trust agent
ipa idrange-find ---------------- 2 ranges matched ---------------- Range name: IDM.EXAMPLE.COM_id_range First Posix ID of the range: 882200000 Number of IDs in the range: 200000 Range type: local domain range Range name: AD.EXAMPLE.COM_id_range First Posix ID of the range: 1337000000 Number of IDs in the range: 200000 Domain SID of the trusted domain: S-1-5-21-4123312420-990666102-3578675309 Range type: Active Directory trust range with POSIX attributes ---------------------------- Number of entries returned 2 ----------------------------
ipa idrange-mod --auto-private-groups=hybrid AD.EXAMPLE.COM_id_range
sss_cache -E
[global] debug=True
systemctl restart httpd
systemctl stop smb winbind
net conf setparm global 'log level' 100
[global] log level = 100
rm /var/log/samba/log.*
systemctl start smb winbind
date; ipa -vvv trust-add --type=ad ad.example.com
mv /etc/ipa/server.conf /etc/ipa/server.conf.backup systemctl restart httpd systemctl stop smb winbind net conf setparm global 'log level' 0 mv /usr/share/ipa/smb.conf.empty /usr/share/ipa/smb.conf.empty.backup systemctl start smb winbind
tar -cvf debugging-trust.tar /var/log/httpd/error_log /var/log/samba/log.*
ipa trust-del ad_domain_name ------------------------------ Deleted trust " ad_domain_name " ------------------------------
ipa idrange-del AD.EXAMPLE.COM_id_range systemctl restart sssd
ipa trust-show ad.example.com ipa: ERROR: ad.example.com: trust not found
cd ~/ MyPlaybooks /
--- - name: Playbook to delete trust hosts: ipaserver vars_files: - /home/user_name/MyPlaybooks/secret.yml tasks: - name: ensure the trust is absent ipatrust: ipaadmin_password: "{{ ipaadmin_password }}" realm: ad.example.com state: absent
ansible-playbook --vault-password-file=password_file -v -i inventory del-trust.yml
ipa idrange-del AD.EXAMPLE.COM_id_range systemctl restart sssd
ipa trust-show ad.example.com ipa: ERROR: ad.example.com: trust not found
ipa idrange-find
ipa idrange-del AD.EXAMPLE.COM_id_range
systemctl restart sssd