From Fedora Project Wiki

(Initial realmd join with sssd page)
 
(Add verification of keytab)
Line 25: Line 25:
# Check that you can resolve domain accounts on the local domain.  
# Check that you can resolve domain accounts on the local domain.  
#: <pre>$ getent passwd 'AD\User'</pre>
#: <pre>$ getent passwd 'AD\User'</pre>
#: Make sure to use the quotes around the user name.
#: You should see an output line that looks like passwd(5) output. It should contain an appropriate home directory, and a shell.
#: You should see an output line that looks like passwd(5) output. It should contain an appropriate home directory, and a shell.
#: Use the <code>login-formats</code> you saw above, to build a remote user name. It will be in the form of <code>DOMAIN\User</code>, where DOMAIN is the first part of your full Active Directory domain name.
#: Use the <code>login-formats</code> you saw above, to build a remote user name. It will be in the form of <code>DOMAIN\User</code>, where DOMAIN is the first part of your full Active Directory domain name.
 
# Check that you have an appropriate entry in your hosts keytab.
#: <pre>sudo klist -k</pre>
#: You should see several lines, with your host name. For example <code>2 HOSTNAME$@AD.EXAMPLE.COM</code>
# Check that you can use your keytab with kerberos
#: <pre>sudo kinit -k 'HOSTNAME$@AD.EXAMPLE.COM'</pre>
#: Make sure to use quotes around the argument, because of the characters in there. Make sure the hostname and domain are capitalized.
#: Use the principal from the output of the <code>klist</code> command above. Use the one that's capitalized and looks like <code>HOSTNAME$@DOMAIN</code>.
#: There should be no output from this command.
}}
}}


Line 36: Line 44:
<pre>
<pre>
$ realm join --verbose ad.example.com
$ realm join --verbose ad.example.com
</pre>
The selinux profile for realmd isn't yet stable, so you may want turn off enforcement. Please do still file bugs for the SElinux AVC notifications you see.
<pre>
$ sudo setenforce 0
</pre>
</pre>


[[Category:Active_Directory_Test_Cases]]
[[Category:Active_Directory_Test_Cases]]

Revision as of 14:40, 16 October 2012

Description

Join the current machine to an Active Directory domain using sssd as an AD client. Domain accounts are available on the local machine once this is done.

Setup

  1. Verify that your Active Directory domain access works. If you don't have an Active Directory domain, you can set one up.
  2. You need a domain account, either a user or administrator. It's useful to test with both.
  3. Your machine must have a configured host name. Do not proceed if you host name is localhost or similar. 
    $ hostname
  4. Make sure you have <package>realmd</package> 0.9 or later installed. 
    $ rpm -q realmd
  5. Remove the following packages, they should be installed by realmd as necessary. 
    $ yum remove sssd samba-client adcli

How to test

  1. Perform the join command. Use the --user=xxx argument to specify your domain account name. 
    $ realm join --user=User ad.example.com
    You will be prompted for a password for the account.
    On a successful join there will be no output.
    This can take up to a few minutes depending on how far away your Active Directory domain is.

Expected Results

  1. Check that the domain is now configured. 
    $ realm list
    Make sure the domain is listed.
    Make sure you have a configured: kerberos-membership line in the output.
    Make note of the login-formats line for the next command.
  2. Check that you can resolve domain accounts on the local domain. 
    $ getent passwd 'AD\User'
    Make sure to use the quotes around the user name.
    You should see an output line that looks like passwd(5) output. It should contain an appropriate home directory, and a shell.
    Use the login-formats you saw above, to build a remote user name. It will be in the form of DOMAIN\User, where DOMAIN is the first part of your full Active Directory domain name.
  3. Check that you have an appropriate entry in your hosts keytab. 
    sudo klist -k
    You should see several lines, with your host name. For example 2 HOSTNAME$@AD.EXAMPLE.COM
  4. Check that you can use your keytab with kerberos 
    sudo kinit -k 'HOSTNAME$@AD.EXAMPLE.COM'
    Make sure to use quotes around the argument, because of the characters in there. Make sure the hostname and domain are capitalized.
    Use the principal from the output of the klist command above. Use the one that's capitalized and looks like HOSTNAME$@DOMAIN.
    There should be no output from this command.



Troubleshooting

Use the --verbose argument to see details of what's being done during a join. Include verbose output in any bug reports. 

$ realm join --verbose ad.example.com

The selinux profile for realmd isn't yet stable, so you may want turn off enforcement. Please do still file bugs for the SElinux AVC notifications you see. 

$ sudo setenforce 0
Retrieved from "https://fedoraproject.org/w/index.php?title=QA:Testcase_realmd_join_sssd&oldid=307179"