Fixed upstream:
master: https://fedorahosted.org/freeipa/changeset/c2034805d323dcf505042d03dbd801561aa64ed3
ipa-3-1: https://fedorahosted.org/freeipa/changeset/f68dd468c8028bca0a05ca314ce79b73fe6ffe08

verified freeipa-server-3.1.3-3.fc18.x86_64


spawn /usr/sbin/ipa-adtrust-install -a Secret123 -U

The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will setup components needed to establish trust to AD domains for
the FreeIPA Server.

This includes:
  * Configure Samba
  * Add trust related objects to FreeIPA LDAP server

To accept the default shown in brackets, press the Enter key.

Configuring CIFS
  [1/18]: stopping smbd
  [2/18]: creating samba domain object
Samba domain object already exists
  [3/18]: creating samba config registry
  [4/18]: writing samba config file
  [5/18]: adding cifs Kerberos principal
  [6/18]: adding cifs principal to S4U2Proxy targets
cifs principal already targeted, nothing to do.
  [7/18]: adding admin(group) SIDs
Admin SID already set, nothing to do
Admin group SID already set, nothing to do
  [8/18]: adding RID bases
RID bases already set, nothing to do
  [9/18]: updating Kerberos config
'dns_lookup_kdc' already set to 'true', nothing to do.
  [10/18]: activating CLDAP plugin
CLDAP plugin already configured, nothing to do
  [11/18]: activating sidgen plugin and task
Sidgen plugin already configured, nothing to do
Sidgen task plugin already configured, nothing to do
  [12/18]: activating extdom plugin
Extdom plugin already configured, nothing to do
  [13/18]: configuring smbd to start on boot
  [14/18]: adding special DNS service records
  [15/18]: restarting Directory Server to take MS PAC and LDAP plugins changes into account
  [16/18]: adding fallback group
Fallback group already set, nothing to do
  [17/18]: setting SELinux booleans
  [18/18]: starting CIFS services
Done configuring CIFS.

=============================================================================
Setup complete:: [   PASS   ] :: Unattended install succeeded  as expected

Verified using:
ipa-server-3.3.3-5.el7.x86_64 
ipa-server-trust-ad-3.3.3-5.el7.x86_64

Automated Test results:

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: adtrust_cli_bz924079: Adtrust install unattented, ticket 3497 - bz924079
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [ 05:26:22 ] ::  https://bugzilla.redhat.com/show_bug.cgi?id=924079
Shutting down all IPA services
Removing IPA client configuration
Unconfiguring ntpd
Unconfiguring CA
Unconfiguring named
Unconfiguring web server
Unconfiguring krb5kdc
Unconfiguring kadmin
Unconfiguring directory server
Unconfiguring smb
Unconfiguring ipa_memcached
Unconfiguring ipa-otpd
:: [   PASS   ] :: Uninstalling IPA server (Expected 0, got 0)

MARK-LWD-LOOP -- 2013-11-26 05:30:27 --
:: [   PASS   ] :: IPA server install with DNS (Expected 0, got 0)

The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will set up the IPA Server.
<..snip..>
:: [   PASS   ] :: File '/tmp/tmp.IZO1fAeQ3l/tmpout.adtrust_cli_bz924079.out' should contain 'Done configuring certificate server' 
:: [   PASS   ] :: File '/tmp/tmp.IZO1fAeQ3l/tmpout.adtrust_cli_bz924079.out' should contain 'Done configuring Kerberos KDC' 
:: [   PASS   ] :: File '/tmp/tmp.IZO1fAeQ3l/tmpout.adtrust_cli_bz924079.out' should contain 'Done configuring DNS (named).' 
:: [   PASS   ] :: File '/tmp/tmp.IZO1fAeQ3l/tmpout.adtrust_cli_bz924079.out' should contain 'Restarting the web server' 
:: [   PASS   ] :: File '/tmp/tmp.IZO1fAeQ3l/tmpout.adtrust_cli_bz924079.out' should contain 'Setup complete' 
:: [   PASS   ] :: Running 'timeout 600 ipa-adtrust-install -a Secret123 -U > /tmp/tmp.IZO1fAeQ3l/tmpout.adtrust_cli_bz924079.out 2>&1' (Expected 0, got 0)

The log file for this installation can be found in /var/log/ipaserver-install.log
==============================================================================
This program will setup components needed to establish trust to AD domains for
the IPA Server.

This includes:
  * Configure Samba
  * Add trust related objects to IPA LDAP server

To accept the default shown in brackets, press the Enter key.


WARNING: 3 existing users or groups do not have a SID identifier assigned.
Installer can run a task to have ipa-sidgen Directory Server plugin generate
the SID identifier for all these users. Please note, the in case of a high
number of users and groups, the operation might lead to high replication
traffic and performance degradation. Refer to ipa-adtrust-install(1) man page
for details.

Unattended mode was selected, installer will NOT run ipa-sidgen task!
Configuring CIFS
  [1/19]: stopping smbd
  [2/19]: creating samba domain object
  [3/19]: creating samba config registry
  [4/19]: writing samba config file
  [5/19]: adding cifs Kerberos principal
  [6/19]: check for cifs services defined on other replicas
  [7/19]: adding cifs principal to S4U2Proxy targets
  [8/19]: adding admin(group) SIDs
  [9/19]: adding RID bases
  [10/19]: updating Kerberos config
'dns_lookup_kdc' already set to 'true', nothing to do.
  [11/19]: activating CLDAP plugin
  [12/19]: activating sidgen plugin and task
  [13/19]: activating extdom plugin
  [14/19]: configuring smbd to start on boot
  [15/19]: adding special DNS service records
  [16/19]: restarting Directory Server to take MS PAC and LDAP plugins changes into account
  [17/19]: adding fallback group
  [18/19]: setting SELinux booleans
  [19/19]: starting CIFS services
Done configuring CIFS.

=============================================================================
Setup complete

You must make sure these network ports are open:
	TCP Ports:
	  * 138: netbios-dgm
	  * 139: netbios-ssn
	  * 445: microsoft-ds
	UDP Ports:
	  * 138: netbios-dgm
	  * 139: netbios-ssn
	  * 389: (C)LDAP
	  * 445: microsoft-ds

Additionally you have to make sure the IPA LDAP server is not reachable
by any domain controller in the Active Directory domain by closing down
the following ports for these servers:
	TCP Ports:
	  * 389, 636: LDAP/LDAPS

You may want to choose to REJECT the network packets instead of DROPing
them to avoid timeouts on the AD domain controllers.

=============================================================================

:: [   PASS   ] :: File '/tmp/tmp.IZO1fAeQ3l/tmpout.adtrust_cli_bz924079.out' should contain 'Unattended mode was selected, installer will NOT run ipa-sidgen task!' 
:: [   PASS   ] :: File '/tmp/tmp.IZO1fAeQ3l/tmpout.adtrust_cli_bz924079.out' should contain 'Done configuring CIFS.' 
:: [   PASS   ] :: File '/tmp/tmp.IZO1fAeQ3l/tmpout.adtrust_cli_bz924079.out' should contain 'Setup complete' 
:: [   PASS   ] :: ldapsearch change in netbios name (Expected 0, got 0)
SASL/EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
SASL SSF: 0
# extended LDIF
#
# LDAPv3
# base <dc=testrelm,dc=com> (default) with scope subtree
# filter: objectclass=ipaNTDomainAttrs
# requesting: ALL
#

# testrelm.com, ad, etc, testrelm.com
dn: cn=testrelm.com,cn=ad,cn=etc,dc=testrelm,dc=com
objectClass: ipaNTDomainAttrs
objectClass: nsContainer
objectClass: top
ipaNTSecurityIdentifier: S-1-5-21-2398299289-603977830-2405623512
cn: testrelm.com
ipaNTDomainGUID: 18dfe834-b6cd-4a7a-b46f-3b889cca7393
ipaNTFlatName: TESTRELM
ipaNTFallbackPrimaryGroup: cn=Default SMB Group,cn=groups,cn=accounts,dc=testr
 elm,dc=com

# search result
search: 3
result: 0 Success

# numResponses: 2
# numEntries: 1
:: [   PASS   ] :: File '/tmp/tmp.IZO1fAeQ3l/tmpout.adtrust_cli_bz924079.out' should contain 'ipaNTFlatName: TESTRELM' 
:: [   PASS   ] :: Ticket 3497 and BZ 924079 resolved 
'93452b69-f65c-4f54-9011-7746665561ed'
adtrust-cli-bz924079 result: PASS

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.