From Fedora Project Wiki
(Update version of realmd) |
(Make the output match reality) |
||
| Line 8: | Line 8: | ||
# Perform a discovery command against your active directory domain. | # Perform a discovery command against your active directory domain. | ||
#: <pre>$ realm discover ad.example.com</pre> | #: <pre>$ realm discover ad.example.com</pre> | ||
#: The output should contain one realm listed. The domain name on the first line, and the also contain the line <code> | #: The output should contain one realm listed. The domain name on the first line, and the also contain the line <code>server-software: active-directory</code> | ||
# Perform a discovery command against a generic kerberos domain, such as <code>nullroute.eu.org</code>. | # Perform a discovery command against a generic kerberos domain, such as <code>nullroute.eu.org</code>. | ||
#: <pre>$ realm discover nullroute.eu.org</pre> | #: <pre>$ realm discover nullroute.eu.org</pre> | ||
Revision as of 21:52, 29 November 2012
Description
realmd automatically discovers information about kerberos realms, and determines whether they are Active Directory domains or other types of kerberos realms.
Setup
- Verify that your Active Directory domain access works. If you don't have an Active Directory domain, you can set one up.
- Make sure you have realmd 0.10 or later installed.
$ yum list realmd
How to test
- Perform a discovery command against your active directory domain.
$ realm discover ad.example.com
- The output should contain one realm listed. The domain name on the first line, and the also contain the line
server-software: active-directory
- Perform a discovery command against a generic kerberos domain, such as
nullroute.eu.org.$ realm discover nullroute.eu.org
- The output should contain one realm listed. The domain name on the first line, and the also contain the line
type: kerberos
- Perform a discovery command against an IPA domain, if you have access to one.
$ realm discover ipa.example.com
- The output should contain one realm listed. The domain name on the first line, and the also contain the line
type: freeipa
Expected Results
- The realms should be discoverable, and should contain the appropriate
type:lines.
Troubleshooting
Use the --verbose argument to see details of what's being done during discovery. You can see output like this:
$ realm discover --verbose nullroute.eu.org * Searching for kerberos SRV records for domain: _kerberos._udp.nullroute.eu.org * Searching for MSDCS SRV records on domain: _kerberos._tcp.dc._msdcs.nullroute.eu.org * virgule.cluenet.org:88 panther.nathan7.eu:88 * Trying to retrieve IPA certificate from virgule.cluenet.org * Trying to retrieve IPA certificate from panther.nathan7.eu ! Couldn't read certificate via HTTP: No PEM-encoded certificate found ! Couldn't discover IPA KDC: No PEM-encoded certificate found * Found kerberos DNS records for: nullroute.eu.org * Successfully discovered: nullroute.eu.org ...
The complete output for the discovery of an Active Directory domain (which is not configured locally) should look something like:
$ realm discover ad.example.com ad.example.com configured: no server-software: active-directory client-software: sssd type: kerberos realm-name: AD.EXAMPLE.COM domain-name: ad.example.com