I have installed an IPA Server, created a replica agreement and set up a one way trust to our AD Forest. The IPA servers have integrated DNS and are in their own dns zone. This works as expected, I am able to log into the IPA servers with my AD account.My issue is when setting up a client, I am able to use IPA users (ex. admin) but unable to authenticate/login with my AD account. Running an HBAC test on the IPA server verified my AD user has access to the client. I can also successfully obtain a kerberos ticket for the AD users on my IPA client. When I perform an id on the AD account from the IPA client I receive an unknown user errorWhen I try to ssh, secure log shows, illegal user/unknown user to underlying authentication module.Environment Details are as follows:IPA Version 4.4.0IPA Server:ipaserver01.ipa.us.example.com CentOS 7.3 IPA Replica:ipaserver02.ipa.us.example.com CentOS 7.3 IPA Client:ipaclient.us.example.com CentOS 7.3 IPA REALM: IPA.US.EXAMPLE.COMAD Forest: win.example.comUser: John.Doe@usa.win.example.com/etc/sssd/sssd.conf:[domain/ipa.us.example.com]cache_credentials = Truekrb5_store_password_if_offline = Trueipa_domain = ipa.us.example.comid_provider = ipaauth_provider = ipaaccess_provider = ipaldap_tls_cacert = /etc/ipa/ca.crtipa_hostname = ipaclient.us.example.comchpass_provider = ipaipa_server = _srv_, ipaserver02.ipa.us.example.comdns_discovery_domain = ipa.us.example.comsubdomain_inherit = ignore_group_membersignore_group_members = Truedebug_level = 6[sssd]domains = ipa.us.example.comconfig_file_version = 2services = nss, sudo, pam, ssh, pacsubdomain_enumerate = alldebug_level = 6[nss]debug_level = 6homedir_substring = /home/etc/krb5.conf#File modified by ipa-client-installincludedir /etc/krb5.conf.d/includedir /var/lib/sss/pubconf/krb5.include.d/[libdefaults]  default_realm = IPA.US.EXAMPLE.COM  dns_lookup_realm = true  dns_lookup_kdc = true  rdns = false  ticket_lifetime = 24h  forwardable = true  udp_preference_limit = 0  default_ccache_name = KEYRING:persistent:%{uid}[realms]  IPA.US.EXAMPLE.COM = {    pkinit_anchors = FILE:/etc/ipa/ca.crt  }[domain_realm]  .ipa.us.example.com = IPA.US.EXAMPLE.COM  ipa.us.example.com = IPA.US.EXAMPLE.COM  ipaclient.us.example.com = IPA.US.EXAMPLE.COM  .us.example.com = IPA.US.EXAMPLE.COM  us.example.com = IPA.US.EXAMPLE.COM/var/log/secureMay 17 10:23:23 lxmatazan100s sshd[8256]: reverse mapping checking getaddrinfo for dhcp-ngkusernetworkuzo-1921690252.revonly.kn [192.169.0.252] failed - POSSIBLE BREAK-IN ATTEMPT!May 17 10:23:47 lxmatazan100s sshd[8256]: Invalid user John.Doe@usa.win.example.com from 192.169.0.252May 17 10:23:47 lxmatazan100s sshd[8256]: input_userauth_request: invalid user John.Doe@usa.win.example.com [preauth]May 17 10:23:50 lxmatazan100s sshd[8256]: Failed password for invalid user John.Doe@usa.win.example.com from 192.169.0.252 port 51819 ssh2May 17 10:23:53 lxmatazan100s sshd[8256]: Failed password for invalid user John.Doe@usa.win.example.com from 192.169.0.252 port 51819 ssh2May 17 10:23:56 lxmatazan100s sshd[8256]: Failed password for invalid user John.Doe@usa.win.example.com from 192.169.0.252 port 51819 ssh2May 17 10:23:56 lxmatazan100s sshd[8256]: error: PAM: User not known to the underlying authentication module for illegal user John.Doe@usa.win.example.com from 192.169.0.252May 17 10:23:56 lxmatazan100s sshd[8256]: Failed keyboard-interactive/pam for invalid user John.Doe@usa.win.example.com from 192.169.0.252 port 51819 ssh2May 17 10:23:56 lxmatazan100s sshd[8256]: Connection closed by 192.169.0.252 [preauth]/var/log/sssd/sssd_ipa.us.example.com (These entries exist for each domain in the AD forest, multiple times!)(Wed May 17 08:25:50 2017) [sssd[be[ipa.us.example.com]]] [_dp_req_recv] (0x0400): DP Request [Account #134]: Receiving request data.(Wed May 17 08:25:50 2017) [sssd[be[ipa.us.example.com]]] [dp_req_reply_gen_error] (0x0080): DP Request [Account #134]: Finished. Backend is currently offline.(Wed May 17 08:25:50 2017) [sssd[be[ipa.us.example.com]]] [dp_table_value_destructor] (0x0400): Removing [0:1:0x0001:1:1:U:usa.win.example.com:name=john.doe@usa.win.example.com] from reply table(Wed May 17 08:25:50 2017) [sssd[be[ipa.us.example.com]]] [dp_req_destructor] (0x0400): DP Request [Account #134]: Request removed.(Wed May 17 08:25:50 2017) [sssd[be[ipa.us.example.com]]] [dp_req_destructor] (0x0400): Number of active DP request: 0/var/log/sssd/sssd_nss.log(Again, these exist for each domain in the AD forest)(Wed May 17 08:25:50 2017) [sssd[nss]] [nss_cmd_getpwnam_search] (0x0100): Requesting info for [john.doe@usa.win.example.com](Wed May 17 08:25:50 2017) [sssd[nss]] [sysdb_search_user_by_upn] (0x0400): No entry with upn [john.doe@usa.win.example.com] found.(Wed May 17 08:25:50 2017) [sssd[nss]] [get_dp_name_and_id] (0x0400): Not a LOCAL view, continuing with provided values.(Wed May 17 08:25:50 2017) [sssd[nss]] [sss_dp_issue_request] (0x0400): Issuing request for [0x7f99f622c880:1:john.doe@usa.win.example.com:U@usa.win.example.com](Wed May 17 08:25:50 2017) [sssd[nss]] [sss_dp_get_account_msg] (0x0400): Creating request for [usa.win.example.com][0x1][BE_REQ_USER][1][name=john.doe@usa.win.example.com:U](Wed May 17 08:25:50 2017) [sssd[nss]] [sss_dp_internal_get_send] (0x0400): Entering request [0x7f99f622c880:1:john.doe@usa.win.example.com:U@usa.win.example.com](Wed May 17 08:25:50 2017) [sssd[nss]] [sss_dp_req_destructor] (0x0400): Deleting request: [0x7f99f622c880:1:john.doe@usa.win.example.com:U@nw.win.example.com](Wed May 17 08:25:50 2017) [sssd[nss]] [sss_dp_get_reply] (0x0010): The Data Provider returned an error [org.freedesktop.sssd.Error.DataProvider.Offline](Wed May 17 08:25:50 2017) [sssd[nss]] [nss_cmd_getby_dp_callback] (0x0040): Unable to get information from Data ProviderError: 3, 5, Failed to get reply from Data ProviderWill try to return what we have in cacheThe one thing I have left to try is move the client to the ipa.us.example.com dns domain, although the documentation specifically mentions clients do not need to be in the same dns domain as the server.EDIT** - I previously had commented out a line /etc/pam.d/password-auth thinking it fixed ipa (non trust) users authentication. I am now thinking it allowed any user to authenticate because when I removed the user from the HBAC rule they could still authenticate. I have uncommented the line, and now IPA users are unable to authenticate. I can still do a lookup for those users (and not AD users). /etc/pam.d/password-auth#%PAM-1.0# This file is auto-generated.# User changes will be destroyed the next time authconfig is run.auth        required      pam_env.soauth        [default=1 success=ok] pam_localuser.soauth        [success=done ignore=ignore default=die] pam_unix.so nullok try_first_passauth        requisite     pam_succeed_if.so uid >= 1000 quiet_successauth        sufficient    pam_sss.so forward_passauth        required      pam_deny.soaccount     required      pam_unix.soaccount     sufficient    pam_localuser.soaccount     sufficient    pam_succeed_if.so uid < 1000 quiet#The following line is what I had commented outaccount     [default=bad success=ok user_unknown=ignore] pam_sss.soaccount     required      pam_permit.sopassword    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtokpassword    sufficient    pam_sss.so use_authtokpassword    required      pam_deny.sosession     optional      pam_keyinit.so revokesession     required      pam_limits.so-session     optional      pam_systemd.sosession     optional      pam_oddjob_mkhomedir.so umask=0077session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uidsession     required      pam_unix.sosession     optional      pam_sss.soEDIT #2** I have now gotten ipa users to work with my client, I had to include selinux_provider=none in the [domain/ipa.us.example.com] section of sssd.conf. AD Trust users are still failing with the same errors.
Why is my IPA Client not recognizing AD Trusted users
centos;sssd;freeipa