This is server a trust agent or controller? Can you provide re-run ipa-healthcheck and provide the debug log?

Rob, 
This is a trust-controller and there is intermittent behaviour seen here.
Also impacted due to #bz1751691

Calling check <ipahealthcheck.ipa.trust.IPATrustCatalogCheck object at 0x7f4114fcaf98>
raw: trust_find(None, version='2.233')
trust_find(None, all=False, raw=False, version='2.233', pkey_only=False)
Starting external process
args=['/usr/sbin/sssctl', 'domain-status', 'win2k16.test', '--active-server']
Process finished, return code=0
stdout=Active servers:
AD Global Catalog: winsync.win2k16.test
AD Domain Controller: winsync.win2k16.test
IPA: master.rhel81.test


  {
    "source": "ipahealthcheck.ipa.trust",
    "check": "IPATrustCatalogCheck",
    "result": "SUCCESS",
    "uuid": "69134c32-1d28-4947-987c-0ecef08e539d",
    "when": "20191209073131Z",
    "duration": "0.004775",
    "kw": {
      "key": "Domain Security Identifier",
      "sid": "S-1-5-21-720774695-2048269649-614676435"
    }
  },


  {
    "source": "ipahealthcheck.ipa.trust",
    "check": "IPATrustCatalogCheck",
    "result": "ERROR",
    "uuid": "620d554c-3f29-4862-9281-466288c4d8e3",
    "when": "20191209073324Z",
    "duration": "0.094163",
    "kw": {
      "key": "domain-status",
      "error": "CalledProcessError(Command ['/usr/sbin/sssctl', 'domain-status', 'win2k16.test', '--active-server'] returned non-zero exit status 1: 'Unable to get online status\\n')",
      "msg": "Execution of {key} failed: {error}"


Calling check <ipahealthcheck.ipa.trust.IPATrustDomainsCheck object at 0x7f8463a9bfd0>
Starting external process
args=['/usr/sbin/sssctl', 'domain-list']
Process finished, return code=1
stdout=
stderr=
Calling check <ipahealthcheck.ipa.trust.IPATrustCatalogCheck object at 0x7f8463b0f438>
raw: trust_find(None, version='2.233')
trust_find(None, all=False, raw=False, version='2.233', pkey_only=False)
Starting external process
args=['/usr/sbin/sssctl', 'domain-status', 'win2k16.test', '--active-server']
Process finished, return code=0
stdout=Active servers:
AD Global Catalog: not connected
AD Domain Controller: not connected
IPA: master.rhel81.test


[root@master ~]# sssctl domain-list
implicit_files
rhel81.test
win2k16.test

Re-assigning to sssd so they can take a look at why sssctl isn't finding the SID.

Hi,

in the original case 02633145 there are neither SSSD logs not the sssd.conf in the sos reports. In the second case the SSSD debug_level is too öow to see any details but there are various authentication errors in the logs so that I assume SSSD cannot connect to AD. Logs with a higher debug_level are needed to understand why authentication is failing.

bye,
Sumit

The issue is when the trust uses an Active Directory trust range with POSIX attributes (ipa-ad-trust-posix).

What this failing check does is test that the trust is online by looking up a user. It uses Administrator (SID + "-500") because it has a fixed value. Resolving the user this should populate the 'AD Global catalog' and 'AD Domain Controller' in the sssctl domain-status output so we can report on the status.

Since the environment is using idrange-type ipa-ad-trust-posix the Administrator user has no UID and GID defined in AD (not the default, has to be added manually) hence not resolvable.

So the check will be skipped for domains configured with ipa-ad-trust-posix.

Hello Team.

I've created a new KCS for this issue.

https://access.redhat.com/solutions/6977745

Very Respectfully,
Daniel C. Filho

upstream 30471ebdc9fe5871c115ca06f78a415275a320e6 in tag 0.12.

c8s MR merged, https://gitlab.com/redhat/centos-stream/rpms/ipa-healthcheck/-/merge_requests/17

The idm module needs to reflect the new branch naming convention, stream-idm-DL1-rhel-8.9.0.

Pre-verified using automation from test_integration/test_ipahealthcheck.py::TestIpaHealthCheckWithADtrust::()::test_ipahealthcheck_trust_catalogcheck with ipa-healthcheck-0.12-2.module+el8.9.0+18911+94941f82.noarch

Passed 	test_integration/test_ipahealthcheck.py::TestIpaHealthCheckWithADtrust::()::test_ipahealthcheck_trust_catalogcheck 	

Full test log is an attachment of this BZ. Marking as verified: tested.

Verified using automation available at test_ipahealthcheck.py::TestIpaHealthCheckWithADtrust::test_ipahealthcheck_trust_catalogcheck with ipa-healthcheck-0.12-2.module+el8.9.0+18911+94941f82.noarch

Passed 	test_integration/test_ipahealthcheck.py::TestIpaHealthCheckWithADtrust::()::test_ipahealthcheck_trust_catalogcheck

Full test run report is available as an attachment of this BZ. Marking as verified.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (idm:client and idm:DL1 bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:6977