Hey Rich,

Tried the command you listed below and it says ldap_bind: Invalid Credentials 
If I take away the -w 'WindowsIDMPassSyncPW' then it will bring back the 
results of the LDAP search.

From: Rich Megginson [mailto:rmegg...@redhat.com]
Sent: Thursday, March 21, 2013 4:12 PM
To: Joseph, Matthew (EXP)
Cc: freeipa-users@redhat.com
Subject: EXTERNAL: Re: [Freeipa-users] Winsync Issues

On 03/21/2013 12:37 PM, Joseph, Matthew (EXP) wrote:

I'm currently in the processing of installing/configuring IPA 2.2.0-16  on a 
Red Hat 6.4 Server and I'm running into some issues trying to get IPA to 
replicate to a Windows 2003 SP2 DC.

Here is the steps I took (I used the Red Hat Identity Management Guide)

1)      Create idmpasssync user under AD and give him the permissions requested

2)      Download IPA cert from web gui

3)      Installed IPA cert under Trusted Root Certificates Authorities

4)      Exported Windows cert to Red Hat Server

5)      Copied both IPA and Windows certs to /etc/openldap/cacerts

6)      Run the following command

a.       Ipa-replica-manage connect -winsync -binddn 
cn=idmpasssync,cn=users,dc=domain,dc=ca -bindpw WindowsIDMPassSyncPW     - 
passsync WindowsIDMPassSyncPW -cacert /etc/openldap/cacerts/windows.cer 
adserver.domain.ca -v

7)      After running that command I get the following error;

a.       Added CA Certificate /etc/openldap/cacerts/windows.cer to certificate 
database for IPAserver.domain.ca
ipa: INFO: Failed to connect to AD server adserver.domain.ca
ipa: INFO: The error was: {'info': 80090308: LdapErr: DSID-0C090334, comment: 
AcceptSecurityContext error, data 525, vece', 'desc': 'Invalid Credentials'}
Failed to setup winsync replication

I checked the IPA logs and it says the same thing above, no new information
I know I entered the password correctly and I even changed it on the Active 
Directory side just to make sure.

Can anyone see what I am doing wrong on this configuration?

Try this:

ldapsearch -xLLL -ZZ -h adserver.domain.ca -D 
"cn=idmpasssync,cn=users,dc=domain,dc=ca" -w 'WindowsIDMPassSyncPW' -s base -b 



Freeipa-users mailing list



Freeipa-users mailing list

Reply via email to