From Fedora Project Wiki

(Add known issues)
(Tweaks, and remove login stuff: different test)
 
(6 intermediate revisions by the same user not shown)
Line 2: Line 2:
|description=Join the current machine to an Active Directory domain using sssd as an AD client, without entering administrative credentials.
|description=Join the current machine to an Active Directory domain using sssd as an AD client, without entering administrative credentials.
|setup=
|setup=
# Due to [https://bugzilla.redhat.com/show_bug.cgi?id=867473 this bug] with [http://lists.fedoraproject.org/pipermail/devel/2012-October/172688.html discussion here], you need to have <code>sss</code> in your <code>/etc/nsswitch.conf</code> when you last booted you system. To do so run this:
# You need the following software:
#: <pre>$ sudo authconfig --update --enablesssd; sudo shutdown -r now</pre>
#* control-center 3.8.1.5 or later
# Unfortunately you need gnome-control-center from git master (or the future to be released 3.6.2 version). This can be [http://developer.gnome.org/jhbuild/unstable/getting-started.html.en built with jhbuild], but takes several hours:
#* realmd 0.14.0 or later
#: <pre>$ jhbuild build gnome-control-center</pre>
# Verify that your [[QA:Testcase_Active_Directory_Setup|Active Directory domain access works, or set a domain up]].
# [[Features/ActiveDirectory/TestBed|Verify that your Active Directory domain access works]]. If you don't have an Active Directory domain, you can [[Features/ActiveDirectory/TestBed|set one up]].
# You need a domain user account and administrator account, or both. If you have both, enter the use account as the user you're going to add below.
# You need a domain user account and administrator account, or both. If you have both, enter the use account as the user you're going to add below.
# Your machine must have a configured host name. Do not proceed if you host name is <code>localhost</code> or similar.
# Your machine must have a configured host name. Do not proceed if you host name is <code>localhost</code> or similar.
#: <pre>$ hostname</pre>
#: <pre>$ hostname</pre>
# Make sure you have [https://admin.fedoraproject.org/updates/FEDORA-2012-16388/realmd-0.9-1.fc18 realmd 0.9] or later installed.
#: <pre>$ yum list realmd</pre>
# Remove the following packages, they should be installed by realmd as necessary.
# Remove the following packages, they should be installed by realmd as necessary.
#: <pre>$ yum remove sssd samba-client adcli</pre>
#: <pre>$ yum remove sssd samba-client adcli</pre>
Line 18: Line 15:
|actions=
|actions=
# Run <code>gnome-control-center</code> from a terminal.
# Run <code>gnome-control-center</code> from a terminal.
# Choose the ''User Accounts'' panel.
# Choose the ''Users'' panel.
# Click the ''Unlock'' button.
# Click the ''Unlock'' button.
#: You should get a Policy Kit authorization prompt.
#: You should get a Policy Kit authorization prompt.
Line 57: Line 54:
#: Look at the <code>permitted-logins:</code> line.
#: Look at the <code>permitted-logins:</code> line.
#: You should also see <code>login-policy: allow-permitted-logins</code>.
#: You should also see <code>login-policy: allow-permitted-logins</code>.
# Go to GDM by logging out, or by ''Switch User'' from the user menu.
# Choose the ''Not Listed?'' option.
#: Verify that you can see the short name listed with a hint as to how to log in.
# Type <code>DOMAIN\User</code> in the box.
#: The case of the domain and user should not matter, but they are separated by a backslash.
#: The domain part is the part of your Active Directory domain prior to the first dot.
# Type the user domain password, and press enter.
# You should be logged into a Fedora Desktop.
}}
}}


Line 71: Line 60:
You can see verbose output in the terminal that you started gnome-control-center from.
You can see verbose output in the terminal that you started gnome-control-center from.


'''Known Issue [[https://bugzilla.redhat.com/show_bug.cgi?id=867873 Selinux]]:''' You need to turn off selinux to complete the permit action. Please do:
[[Category:Active_Directory_Test_Cases]] [[Category:realmd_Test_Cases]]
 
<pre>
$ sudo setenforce 0
</pre>
 
Please file the all realmd AVC's at this bug: https://bugzilla.redhat.com/show_bug.cgi?id=867873
 
<pre>
$ sudo grep realmd /var/log/audit/audit.log
</pre>
 
'''Known Issue [[https://bugzilla.gnome.org/show_bug.cgi?id=686390 Timeout]]:''' Timeout reached while adding Enterprise login.
 
You need this patch: http://bugzilla-attachments.gnome.org/attachment.cgi?id=226752
 
 
 
[[Category:Active_Directory_Test_Cases]]

Latest revision as of 10:36, 9 May 2013

Description

Join the current machine to an Active Directory domain using sssd as an AD client, without entering administrative credentials.

Setup

  1. You need the following software:
    • control-center 3.8.1.5 or later
    • realmd 0.14.0 or later
  2. Verify that your Active Directory domain access works, or set a domain up.
  3. You need a domain user account and administrator account, or both. If you have both, enter the use account as the user you're going to add below.
  4. Your machine must have a configured host name. Do not proceed if you host name is localhost or similar. 
    $ hostname
  5. Remove the following packages, they should be installed by realmd as necessary. 
    $ yum remove sssd samba-client adcli
  6. Make sure you are not joined to a domain. Use realm list to check, and realm leave to leave.

How to test

  1. Run gnome-control-center from a terminal.
  2. Choose the Users panel.
  3. Click the Unlock button.
    You should get a Policy Kit authorization prompt.
  4. Click the add [+] button in the lower left.
  5. Choose the Enterprise login pane.
  6. Enter an invalid domain, invalid user, and invalid password for the account.
    Click on Add. You should see a problem icon on the domain.
  7. Enter the valid domain, invalid user, and invalid password for the account.
    Click on Add. You should see a problem icon on the user.
  8. Enter the valid domain, valid user, and invalid password for the account.
    Click on Add. You should see a problem icon on the password.
  9. Enter the right password.
  10. Click on Add
    If you user a non-administrative user, you may be prompted for administrative credentials. It is tricky to duplicate this at times. Active Directory is an odd one like that :)

Expected Results

  1. The user should now be listed in the User Accounts panel of the GNOME Control Center.
  2. Check that the domain is now configured. 
    $ realm list
    Make sure the domain is listed.
    Make sure you have a configured: kerberos-membership line in the output.
    Make note of the login-formats line for the next command.
  3. Check that you can resolve domain accounts on the local computer. 
    $ getent passwd 'AD\User'
    Make sure to use the quotes around the user name.
    You should see an output line that looks like passwd(5) output. It should contain an appropriate home directory, and a shell.
    Use the login-formats you saw above, to build a remote user name. It will be in the form of DOMAIN\User, where DOMAIN is the first part of your full Active Directory domain name.
  4. Check that you have an appropriate entry in your hosts keytab. 
    sudo klist -k
    You should see several lines, with your host name. For example 2 HOSTNAME$@AD.EXAMPLE.COM
  5. Check that you can use your keytab with kerberos 
    sudo kinit -k 'HOSTNAME$@AD.EXAMPLE.COM'
    Make sure to use quotes around the argument, because of the characters in there. Make sure the hostname and domain are capitalized.
    Use the principal from the output of the klist command above. Use the one that's capitalized and looks like HOSTNAME$@DOMAIN.
    There should be no output from this command.
  6. The user should show up here: 
    $ realm list
    Look at the permitted-logins: line.
    You should also see login-policy: allow-permitted-logins.



Troubleshooting

You can see verbose output in the terminal that you started gnome-control-center from.

Retrieved from "https://fedoraproject.org/w/index.php?title=QA:Testcase_realmd_control_center&oldid=336347"