From Fedora Project Wiki
(Add --verbose output) |
(Link to realmd 0.9) |
||
| Line 3: | Line 3: | ||
|setup= | |setup= | ||
# [[Features/ActiveDirectory/TestBed|Verify that your Active Directory domain access works]]. If you don't have an Active Directory domain, you can [[Features/ActiveDirectory/TestBed|set one up]]. | # [[Features/ActiveDirectory/TestBed|Verify that your Active Directory domain access works]]. If you don't have an Active Directory domain, you can [[Features/ActiveDirectory/TestBed|set one up]]. | ||
# Make sure you have | # Make sure you have [https://admin.fedoraproject.org/updates/FEDORA-2012-16388/realmd-0.9-1.fc18 realmd 0.9] or later installed. | ||
#: <pre>$ | #: <pre>$ yum list realmd</pre> | ||
|actions= | |actions= | ||
# Perform a discovery command against your active directory domain. | # Perform a discovery command against your active directory domain. | ||
Revision as of 08:02, 18 October 2012
Description
realmd automatically discovers information about kerberos realms, and determines whether they are Active Directory domains or other types of kerberos realms.
Setup
- Verify that your Active Directory domain access works. If you don't have an Active Directory domain, you can set one up.
- Make sure you have realmd 0.9 or later installed.
$ yum list realmd
How to test
- Perform a discovery command against your active directory domain.
$ realm discover ad.example.com
- The output should contain one realm listed. The domain name on the first line, and the also contain the line
type: active-directory
- Perform a discovery command against a generic kerberos domain, such as
nullroute.eu.org.$ realm discover nullroute.eu.org
- The output should contain one realm listed. The domain name on the first line, and the also contain the line
type: kerberos
- Perform a discovery command against an IPA domain, if you have access to one.
$ realm discover ipa.example.com
- The output should contain one realm listed. The domain name on the first line, and the also contain the line
type: freeipa
Expected Results
- The realms should be discoverable, and should contain the appropriate
type:lines.
Troubleshooting
Use the --verbose argument to see details of what's being done during discovery. You can see output like this:
$ realm discover --verbose nullroute.eu.org * Searching for kerberos SRV records for domain: _kerberos._udp.nullroute.eu.org * Searching for MSDCS SRV records on domain: _kerberos._tcp.dc._msdcs.nullroute.eu.org * virgule.cluenet.org:88 panther.nathan7.eu:88 * Trying to retrieve IPA certificate from virgule.cluenet.org * Trying to retrieve IPA certificate from panther.nathan7.eu ! Couldn't read certificate via HTTP: No PEM-encoded certificate found ! Couldn't discover IPA KDC: No PEM-encoded certificate found * Found kerberos DNS records for: nullroute.eu.org * Successfully discovered: nullroute.eu.org ...
The complete output for the discovery of an Active Directory domain (which is not configured locally) should look something like:
$ realm discover ad.example.com ad.example.com configured: no server-software: active-directory client-software: sssd type: kerberos realm-name: AD.EXAMPLE.COM domain-name: ad.example.com