On Tue, Oct 29, 2019 at 01:26:32PM +0000, TOULMONDE Sébastien (SPC/DCS) via FreeIPA-users wrote:

Ok, so here’s the solution I found almost by accident…

If I specify the domain search order to ‘ad.domain:ipa.domain’ -> the clients can now resolve the external users If, for whatever reason, the search order is empty, the clients are back to ipa-only resolve…

Hi,

is there a chance that there are users or groups in AD and IPA with the same short name? In this case you might have hit https://bugzilla.redhat.com/show_bug.cgi?id=1746878.

bye, Sumit

Hope it helps someone 😊

Sébastien Toulmonde Linux Engineering | ITS Linux CC

M +32 (0)475 49 81 45

[Proximus]http://www.proximus.be/

Connect with us on:

[Proximus Facebook]https://www.facebook.com/proximusBe [Proximus Twitter] https://twitter.com/proximus [Proximus YouTube] https://www.youtube.com/proximus [Proximus LinkedIn] https://www.linkedin.com/company/proximus

This e-mail cannot be used for other purposes than Proximus business use. See more on https://www.proximus.be/maildisclaimer

---

FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste...