Latest revision as of 11:49, 14 May 2013

Description

Join the current machine to an Active Directory using OpenLMI

Setup

We need to gather SELinux AVC's, be sure to gather all AVC's generated by this test case. See Troubleshooting section below
```
$ sudo setenforce 0
```

Install the components

$ sudo yum install tog-pegasus pywbem realmd

Download the realm CIM scriptlet

$ sudo wget -O /usr/local/bin/realmd-cim http://jdennis.fedorapeople.org/realmd-cim

Make it executable

$ sudo chmod +x /usr/local/bin/realmd-cim

Start the pgasus CIMOM

$ sudo systemctl start tog-pegasus.service

Verify pegasus is running
```
$ sudo systemctl status tog-pegasus
```
Make sure you have other required software:
- realmd 0.14.0 or later
- adcli 0.7 or later
- openlmi-providers 0.21 or later
```
$ sudo yum install realmd openlmi-providers openlmi-realmd
```
Verify the OpenLMI Realmd provider is properly registered
```
$ sudo cimprovider -l
```

If the previous command did not list cmpiLMI_Realmd register the provider manually

$ sudo openlmi-mof-register register /usr/share/openlmi-providers/60_LMI_Realmd.mof /usr/share/openlmi-providers/60_LMI_Realmd.reg

Set the pegasus password, in this example we'll use XXXX as the password
```
$ sudo passwd pegasus
```
Verify that your Active Directory domain access works, or set a domain up.

How to test

Show joined domains

$ realm list
$ realmd-cim -u pegasus -p XXXX list

realmd-cim should show equivalent information as to what realmd-cim shows

Join a domain

$ realmd-cim -u pegasus -p XXXX join Administrator DomainPassword ad.example.com

Expected Results

Check if you are joined to the domain
```
realm list
```
The domain should be listed

Make note of the login format
Check that domain accounts can be resolved
```
getent passwd 'AD\User'
```
Make sure to use the quotes around the user name.

You should see an output line that looks like passwd(5) output. It should contain an appropriate home directory, and a shell.

Use the login-formats you saw above, to build a remote user name. It will be in the form of DOMAIN\User, where DOMAIN is the first part of your full Active Directory domain name.
Check that you have an appropriate entry in your hosts keytab.
```
sudo klist -k
```
Check that you can use your keytab with kerberos
```
sudo kinit -k 'HOSTNAME$@AD.EXAMPLE.COM'
```
Make sure to use quotes around the argument, because of the characters in there. #: Make sure the hostname and domain are capitalized.

Use the principal from the output of the klist command above. Use the one that's capitalized and looks like HOSTNAME$@DOMAIN.

There should be no output from this command.
Try to log into the machine as a domain account at the console.
This should automatically create a new home directory for the user, and log into a shell prompt.

More: Explore the realmd-cim script

Use realmd-cim --help to see how to leave a domain.

More: Try it with FreeIPA

Use a FreeIPA domain with the OpenLMI join.

Troubleshooting

RHBZ #961207 When you see SELinux AVC's report them AVC's to this bug.

$ sudo setenforce permissive
... do the test
$ sudo less /var/log/audit/audit.log

@@ Line 5: / Line 5: @@
 #: <pre>$ sudo setenforce 0</pre>
 # Install the components
-#: <pre>$ sudo yum install sblim-sfcb tog-pegasus pywbem realmd openlmi-realmd</pre>
+#: <pre>$ sudo yum install tog-pegasus pywbem realmd</pre>
 # Download the realm CIM scriptlet
 #: <pre>$ sudo wget -O /usr/local/bin/realmd-cim http://jdennis.fedorapeople.org/realmd-cim</pre>
 # Make it executable
 #: <pre>$ sudo chmod +x /usr/local/bin/realmd-cim</pre>
+# Start the pgasus CIMOM
+#: <pre>$ sudo systemctl start tog-pegasus.service</pre>
 # Verify pegasus is running
-#: <pre>$ sudo systemctl start tog-pegasus sblim-sfcb</pre>
+#: <pre>$ sudo systemctl status tog-pegasus</pre>
-# Set the pegasus password, in this example we'll use XXXX as the password
-#: <pre>$ sudo passwd pegasus</pre>
 # Make sure you have other required software:
 #* realmd 0.14.0 or later
 #* adcli 0.7 or later
 #* openlmi-providers 0.21 or later
+#: <pre>$ sudo yum install realmd openlmi-providers openlmi-realmd</pre>
+# Verify the OpenLMI Realmd provider is properly registered
+#:  <pre>$ sudo cimprovider -l</pre>
+# If the previous command did not list cmpiLMI_Realmd register the provider manually
+#: <pre>$ sudo openlmi-mof-register register /usr/share/openlmi-providers/60_LMI_Realmd.mof /usr/share/openlmi-providers/60_LMI_Realmd.reg</pre>
+# Set the pegasus password, in this example we'll use XXXX as the password
+#: <pre>$ sudo passwd pegasus</pre>
 # Verify that your [[QA:Testcase_Active_Directory_Setup|Active Directory domain access works, or set a domain up]].

Search

QA:Testcase realmd join openlmi: Difference between revisions