Проблема

Не возможно добавить пользователя доверенного домена MS AD в группу external.

Диагностика

  • Проверить, что выполнение команд вида:
    ipa group-add --desc='ad domain external map' ad_admins_external --external
ipa group-add --desc='ad domain users' ad_admins
ipa group-add-member ad_admins_external --external 'windomain.ad\Domain Admins'
    завершается с ошибками.
    dc181:~# ipa -d group-add-member ad_admins_external --external 'WINDOMAIN.AD\Domain Admins'
ipa: DEBUG: Loading Index file from '/var/lib/ipa-client/sysrestore/sysrestore.index'
ipa: DEBUG: Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
ipa: DEBUG: Loading StateFile from '/var/lib/ipa-client/sysrestore/sysrestore.state'
ipa: DEBUG: importing all plugin modules in ipaclient.remote_plugins.schema$bae153e5...
ipa: DEBUG: importing plugin module ipaclient.remote_plugins.schema$bae153e5.plugins
ipa: DEBUG: importing all plugin modules in ipaclient.plugins...
ipa: DEBUG: importing plugin module ipaclient.plugins.automember
ipa: DEBUG: importing plugin module ipaclient.plugins.automount
ipa: DEBUG: importing plugin module ipaclient.plugins.ca
ipa: DEBUG: importing plugin module ipaclient.plugins.cert
ipa: DEBUG: importing plugin module ipaclient.plugins.certmap
ipa: DEBUG: importing plugin module ipaclient.plugins.certprofile
ipa: DEBUG: importing plugin module ipaclient.plugins.csrgen
ipa: DEBUG: importing plugin module ipaclient.plugins.dns
ipa: DEBUG: importing plugin module ipaclient.plugins.hbacrule
ipa: DEBUG: importing plugin module ipaclient.plugins.hbactest
ipa: DEBUG: importing plugin module ipaclient.plugins.host
ipa: DEBUG: importing plugin module ipaclient.plugins.idrange
ipa: DEBUG: importing plugin module ipaclient.plugins.internal
ipa: DEBUG: importing plugin module ipaclient.plugins.location
ipa: DEBUG: importing plugin module ipaclient.plugins.migration
ipa: DEBUG: importing plugin module ipaclient.plugins.misc
ipa: DEBUG: importing plugin module ipaclient.plugins.otptoken
ipa: DEBUG: importing plugin module ipaclient.plugins.otptoken_yubikey
ipa: DEBUG: importing plugin module ipaclient.plugins.passwd
ipa: DEBUG: importing plugin module ipaclient.plugins.permission
ipa: DEBUG: importing plugin module ipaclient.plugins.rpcclient
ipa: DEBUG: importing plugin module ipaclient.plugins.server
ipa: DEBUG: importing plugin module ipaclient.plugins.service
ipa: DEBUG: importing plugin module ipaclient.plugins.sudorule
ipa: DEBUG: importing plugin module ipaclient.plugins.topology
ipa: DEBUG: importing plugin module ipaclient.plugins.trust
ipa: DEBUG: importing plugin module ipaclient.plugins.user
ipa: DEBUG: importing plugin module ipaclient.plugins.vault
ipa: DEBUG: found session_cookie in persistent storage for principal 'admin@FREE.IPA', cookie: 'ipa_session=MagBearerToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c'
ipa: DEBUG: setting session_cookie into context 'ipa_session=MagBearerToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c'
ipa: DEBUG: trying https://dc181.free.ipa/ipa/session/json
ipa: DEBUG: Created connection context.rpcclient_138521076744144
[member user]: 
[member group]: 
[member service]: 
[member User ID override]: 
ipa: DEBUG: raw: group_add_member('ad_admins_external', ipaexternalmember='WINDOMAIN.AD\\Domain Admins', version='2.239')
ipa: DEBUG: group_add_member('ad_admins_external', ipaexternalmember=('WINDOMAIN.AD\\Domain Admins',), version='2.239')
ipa: DEBUG: [try 1]: Forwarding 'group_add_member/1' to json server 'https://dc181.free.ipa/ipa/session/json'
ipa: DEBUG: New HTTP connection (dc181.free.ipa)
ipa: DEBUG: Destroyed connection context.rpcclient_138521076744144
ipa: ERROR: произошла внутренняя ошибка

Возможная причина: FreeIPA. Внутренняя ошибка команды. Перейти к решению.

Возможные причины