Revision as of 06:25, 15 April 2013

Description

Leave a FreeIPA domain by deconfiguring it locally.

Verify that your FreeIPA domain access works. If you don't have a FreeIPA domain, you can set one up.
Run through the test case to join the domain.
Verify that you are joined to the domain with the following command
```
$ realm list
```
Make sure you have a configured: kerberos-member line in the output.

Note the login-formats: line.
Check that you can resolve domain accounts on the local computer.
Use the login-formats you saw above, to build a remote user name. It will be in the form of User@FULL-DOMAIN, where FULL-DOMAIN is your full FreeIPA domain name (e.g. freeipa.example.com)
```
$ getent passwd 'User@freeipa.example.com'
```

Check that the domain is no longer configured.
```
$ realm list
```
Make sure the domain is not listed.
Check that you cannot resolve domain accounts on the local computer.
```
$ getent passwd 'User@freeipa.example.com'
```
There should be no output.
Check that there is no machine account for the domain in the keytab.
```
sudo klist -k
```
You should see no lines referring to the domain in the table, or an error message saying that the keytab does not exist.
If you have console access to a FreeIPA server, you can use the FreeIPA Web UI tool see that the computer account was not deleted.

Use the --verbose argument to see details of what's being done during a leave. Include verbose output in any bug reports.

$ realm leave --verbose freeipa.example.com

Known Issue [Selinux]: You need to turn off selinux to complete the join. Please do:

$ sudo setenforce 0

$ sudo grep realmd /var/log/audit/audit.log

@@ Line 2: / Line 2: @@
 |description=Leave a FreeIPA domain by deconfiguring it locally.
 |setup=
-# [[Features/FreeIPA/TestBed|Verify that your FreeIPA domain access works]]. If you don't have a FreeIPA domain, you can [[Features/FreeIPA/TestBed|set one up]].
+# [[Features/FreeIPA/TestBed|Verify that your FreeIPA domain access works]]. If you don't have a FreeIPA domain, you can [[QA:Testcase_freeipav3_installation|set one up]].
 # Run through the [[QA:Testcase_FreeIPA_realmd_join_sssd|test case to join the domain]].
 # Verify that you are joined to the domain with the following command