Sumit is actively working on this bug.

master
    ce29aa8998332fd3c2e4e4b81e7302d41c461893
    bbd43fbcd8f70eedeac4e4ce01c36256cde82ab1
    c5711b0279ea85d69fe3c77dfb194360c346e1d7 
sssd-1-11:
    2ad333640cdd48e64ffb3183dcdede747285dcd1
    0ee14e804e5a6ef6c0fbcc006c376d7cd51a960f
    a091e5b7831ea84c739493dc20a84ad834f6df7e

Temporarily moving bugs to MODIFIED to work around errata tool bug

To verify this ticket you should check the SSSD-generated krb5.conf include file /var/lib/sss/pubconf/krb5.include.d/domain_realm_IPA_REALM on a FreeIPA host with trust to an AD forest with more than one domain.

In this file all domain-REALM pairs of the AD forest should be listed in the [domain_realm] section and in the [capaths] section should see entries like

FOREST.MEMBER = {
  IPA.REALM = FOREST.ROOT

IPA.REALM = {
  FOREST.MEMBER = FOREST.ROOT
}

for every domain in the forest except the forest root.

[root@dhcp207-218 ~]# echo Secret123 | ipa trust-add adtest.qe --type ad --admin administrator --password
--------------------------------------------------
Added Active Directory trust for realm "adtest.qe"
--------------------------------------------------
  Realm name: adtest.qe
  Domain NetBIOS name: ADTEST
  Domain Security Identifier: S-1-5-21-1910160501-511572375-3625658879
  SID blacklist incoming: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2, S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7, S-1-5-8, S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12, S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16,
                          S-1-5-17, S-1-5-18, S-1-5-19, S-1-5-20
  SID blacklist outgoing: S-1-0, S-1-1, S-1-2, S-1-3, S-1-5-1, S-1-5-2, S-1-5-3, S-1-5-4, S-1-5-5, S-1-5-6, S-1-5-7, S-1-5-8, S-1-5-9, S-1-5-10, S-1-5-11, S-1-5-12, S-1-5-13, S-1-5-14, S-1-5-15, S-1-5-16,
                          S-1-5-17, S-1-5-18, S-1-5-19, S-1-5-20
  Trust direction: Two-way trust
  Trust type: Active Directory domain
  Trust status: Established and verified

[root@dhcp207-218 ~]# cat /var/lib/sss/pubconf/krb5.include.d/domain_realm_newdom_qe
[domain_realm]

[root@dhcp207-218 ~]# ipa trustdomain-find adtest.qe
  Domain name: adtest.qe
  Domain NetBIOS name: ADTEST
  Domain Security Identifier: S-1-5-21-1910160501-511572375-3625658879
  Domain enabled: True

  Domain name: pune.adtest.qe
  Domain NetBIOS name: PUNE
  Domain Security Identifier: S-1-5-21-91314187-2404433721-1858927112
  Domain enabled: True
----------------------------
Number of entries returned 2
----------------------------

[root@dhcp207-218 ~]# cat /var/lib/sss/pubconf/krb5.include.d/domain_realm_newdom_qe
[domain_realm]

[root@dhcp207-218 ~]# getent passwd testu1.qe
testu1.qe:*:839001108:839001108:testu1 user:/home/pune.adtest.qe/testu1:

* File contents get added as expected after a while or when a lookup is done for a user in trusted domain

[root@dhcp207-218 ~]# cat /var/lib/sss/pubconf/krb5.include.d/domain_realm_newdom_qe
[domain_realm]
.adtest.qe = ADTEST.QE
adtest.qe = ADTEST.QE
.pune.adtest.qe = PUNE.ADTEST.QE
pune.adtest.qe = PUNE.ADTEST.QE
[capaths]
PUNE.ADTEST.QE = {
  NEWDOM.QE = ADTEST.QE
}
NEWDOM.QE = {
  PUNE.ADTEST.QE = ADTEST.QE
}

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.