Bug 1029856

Summary: Improve error reporting for adding trust case
Product: Red Hat Enterprise Linux 7 Reporter: Martin Kosek <mkosek>
Component: ipaAssignee: Martin Kosek <mkosek>
Status: CLOSED CURRENTRELEASE QA Contact: Namita Soman <nsoman>
Severity: unspecified Docs Contact:
Priority: medium    
Version: 7.0CC: abokovoy, mkosek, nsoman, rcritten, sbose, sgoveas, spoore
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: ipa-3.3.3-5.el7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-13 12:57:15 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Martin Kosek 2013-11-13 11:28:38 UTC 
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/4024

When establishing trust IPA might report following error message:

{{{
[root@host ~]# ipa trust-add ipaqe.com --type=ad --admin administrator --password
Active directory domain administrator's password:
ipa: ERROR: CIFS server communication error: code "-1073741811",
                message "Unexpected information received" (both may be "None")
}}}

The error code -1073741811 is NT_STATUS_INVALID_PARAMETER. What happens is that Samba library that we use tries to establish an authenticated connection to the AD DC using Kerberos credentials of the AD administrator and that fails  due to Kerberos-related issue.

In most cases the actual issue is clock skew, so it would be good to suggest to check time difference between AD and IPA.
Comment 1 Martin Kosek 2013-11-13 11:30:27 UTC 
Fixed upstream:
master: https://fedorahosted.org/freeipa/changeset/3693b8e51ae11b4bcda9cd7e90ff729fc66a5862
ipa-3-3: https://fedorahosted.org/freeipa/changeset/d2fbcd121eaeb56ab36da6b2f84c780e3af14125
Comment 4 Scott Poore 2014-01-28 19:45:11 UTC 
How can we reproduce this one?

I tried skewing the clock a few times and running trust-add but, it's no longer failing.
Comment 5 Martin Kosek 2014-01-29 08:04:17 UTC 
Alexander or Sumit, can you please advise?
Comment 6 Sumit Bose 2014-02-11 08:02:57 UTC 
Recent MIT Kerberos versions contain a fix by Stef Walter which fixes  the clock skew issue for TGT requests. So I think this ticket can only be verified by checking if /usr/lib/python2.7/site-packages/ipaserver/dcerpc.py contains explanations for error code -1073741811 (NT_STATUS_INVALID_PARAMETER).
Comment 7 Steeve Goveas 2014-02-11 11:41:37 UTC 
[root@dhcp207-151 ~]# grep -A4 1073741811 /usr/lib/python2.7/site-packages/ipaserver/dcerpc.py
    -1073741811: # NT_STATUS_INVALID_PARAMETER
        errors.RemoteRetrieveError(
            reason=_('AD domain controller complains about communication sequence. It may mean unsynchronized time on both sides, for example')),
}

Verified in version
[root@dhcp207-151 ~]# rpm -qf /usr/lib/python2.7/site-packages/ipaserver/dcerpc.py
ipa-server-trust-ad-3.3.3-17.el7.x86_64
Comment 8 Ludek Smid 2014-06-13 12:57:15 UTC 
This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.