On 08/06/2012 02:28 AM, Baptiste AGASSE wrote:
Hi,

Hi,

Hi all,

i've a problem with winsync between ipa 2.2 on centos 6.3 and
Active
directory 2008R2.

I'm following this documentation to enable synchronization:
http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/Setting_up_Active_Directory.html
There is nothing on this page about running certutil? Which link
talks
about certutil?
Links present in the documentation talk about commands and options
for certutil but i don't see anything about this error.
http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Identity_Management_Guide/managing-sync-agmt.html


Can one of the IPA developers explain why it is necessary to install
the
IPA CA certificate into the Windows Cert Store in order to get
Winsync/PassSync working? I don't believe it is necessary.

For now, just skip steps 1 and 2 under 8.4.1. Trusting the Active
Directory and IPA CA Certificates
- I trusted IPA certificate on AD.
To do this, i've launched mmc and added "Certificate" component for "local 
computer", and then added IPA cert to Trusted root CA.

Now when i run "openssl s_client -host ad-server.example.com -port 636" i can 
see IPA certificate as Trusted client CA.

- I tested AD ldap connection:
LDAPTLS_CACERTDIR=/etc/dirsrv/slapd-EXAMPLE-LOCAL ldapsearch -xLLL -H ldap://ad-server.example.com 
-ZZ -D "cn=ipasync,cn=users,dc=example,dc=com" -w XXXXX -s base -b "" 
'objectclass=*' namingcontexts
dn:
namingContexts: DC=example,DC=com
namingContexts: CN=Configuration,DC=example,DC=com
namingContexts: CN=Schema,CN=Configuration,DC=example,DC=com
namingContexts: DC=DomainDnsZones,DC=example,DC=com
namingContexts: DC=ForestDnsZones,DC=example,DC=com

- Now i fall on another problem, when i run:

ipa-replica-manage connect --winsync --binddn 
cn=ipasync,cn=users,dc=example,dc=com --bindpw XXXXX --passsync XXXXX --cacert 
/etc/openldap/cacerts/ad-ca.crt ad-server.example.com -v
Directory Manager password:

Added CA certificate /etc/openldap/cacerts/ad-ca.crt to certificate database 
for ipa.foo.example.local
ipa: INFO: AD Suffix is: DC=example,DC=com
The user for the Windows PassSync service is 
uid=passsync,cn=sysaccounts,cn=etc,dc=example,dc=com
Windows PassSync entry exists, not resetting password
ipa: INFO: Added new sync agreement, waiting for it to become ready . . .
ipa: INFO: Replication Update in progress: FALSE: status: -11  - System error: 
start: 0: end: 0
ipa: INFO: Agreement is ready, starting replication . . .
Starting replication, please wait until this has completed.
[ipa.foo.example.local] reports: Update failed! Status: [-11  - System error]
Failed to start replication
What platform?  What version of 389-ds-base?
Can you post some excerpts from your 389 errors log from /var/log/dirsrv/slapd-YOUR-DOMAIN/errors from around the time of the error?



I a newbie on Microsoft OSes, but I don't understand why certutil
don't find my file.

I will ask on a microsoft forum.

Regards

When i run as admin 'certutil -installcert -v -config
"ipa.foo.example.local\EXAMPLE.LOCAL Domain CA"
c:\Users\John\Documents\ipa-ca.crt' it returns (translated from
french) :

CertUtil : -installCert command failure : 0x80070002 (WIN32: 2)
CertUtil: Specified file not found

someone saw this issue ?

Have a nice day.

Regards.

Baptiste.

_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users
Have a nice day.

Regards

Baptiste.

_______________________________________________
Freeipa-users mailing list
Freeipa-users@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-users

Reply via email to