Issue

Hello,

We are deploying freeIPA (single node) on a developement environment using Centos 7 VM.
FreeIPA deployment was done successfully.
We wanted to configure two-way trust with our AD so that AD users can be able to access linux clients.
Trust was OK, but clients are not able to access to the clients.

Steps to Reproduce

1.Install the Free-IPA server on centos 7 VM
2.Create two-way trust between AD and Free-IPA server (AD=Windows Server 2016)
3.Create local group and map it with external AD group

Used guide: https://www.freeipa.org/page/Active_Directory_trust_setup

Actual behavior

Trust is well established.
authentication for local users created on freeipa platform works fine
authentication for AD users not working (tested from both linux and windows clients)

When I try to access linux host I got the below error messages

AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) IP: CLIENT_NOT_FOUND: host/xxxxxxxxxxx@IPA.DOMAIN for krbtgt/IPA.DOMAIN@IPA.DOMAIN, Client not found in Kerberos database
closing down fd 12
AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) IP: REFERRAL: username\@ADDOMAIN@IPA.DOMAIN for krbtgt/IPA.DOMAIN@IPA.DOMAIN, Realm not local to KDC
closing down fd 12
TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) IP: NO PREAUTH: authtime 0, ausername\@AD@IPA.DOMAIN for host/xxxxxxxxxxx@IPA.DOMAIN@IPA.DOMAIN, Generic error (see e-text)
closing down fd 12
TGS_REQ (8 etypes {18 17 20 19 16 23 25 26}) IP: NO PREAUTH: authtime 0, username@ADDOMAIN for host/xxxxxxxxxxx@IPA.DOMAIN@IPA.DOMAIN, Generic error (see e-text)
closing down fd 12
AS_REQ (8 etypes {18 17 20 19 16 23 25 26}) IP: REFERRAL: username@ADDOMAIN for krbtgt/IPA.DOMAIN@IPA.DOMAIN, Realm not local to KDC

Expected behavior

Authentication success for AD users

Version/Release/Distribution

package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.6.8-5.el7.centos.7.x86_64
ipa-client-4.6.8-5.el7.centos.7.x86_64
389-ds-base-1.3.10.2-12.el7_9.x86_64
pki-ca-10.5.18-15.el7_9.noarch
krb5-server-1.15.1-50.el7.x86_64

Additional info:

I had an error message saying additional pre-authentication required but I have disabled that option using modprinc -requires_preauth krbtgt/REALM
I have also edited the /etc/krb.conf file to add these lines
auth_to_local = RULE:1:$1@$0s/@ADDOMAIN/@addomain/
auth_to_local = DEFAULT

clients are able to recognize the AD users, example:
getent passwd username@addomain
username@addomain:*:243xxx418:243xxx418:user:/home/addomain/user

I even can su - aduser when accessing to client using root account.
For example :
ssh root@IP
su - aduser@addomain
OK (which is normal since root account can access to any account without typing the password)

kinit user@addomain works fine as well

Any help with this?
Thanks !