No edit summary |
No edit summary |
||
Line 44: | Line 44: | ||
$ realm join --verbose ipa.example.org | $ realm join --verbose ipa.example.org | ||
</pre> | </pre> | ||
'''Known Issue [[https://bugzilla.redhat.com/show_bug.cgi?id=953151 missing dependency]]:''' realmd has a missing dependency: glib-networking. Please do: | |||
<pre> # yum install glib-networking </pre> | |||
The selinux profile for realmd isn't yet stable, so you may want turn off enforcement. Please do still file bugs for the SElinux AVC notifications you see. | The selinux profile for realmd isn't yet stable, so you may want turn off enforcement. Please do still file bugs for the SElinux AVC notifications you see. |
Revision as of 13:19, 17 April 2013
Description
Join the current machine to a FreeIPA domain. Domain accounts are available on the local machine once this is done.
Setup
- This testcase assumes you have already set up a FreeIPA domain (named "ipa.example.org"). If you haven't, you can set one up.
- Your machine must have a configured host name. Do not proceed if your host name is
localhost
or similar.$ hostname
- Make sure you have realmd 0.13 or later installed.
$ yum list realmd
How to test
- Perform the join command using IPA's admin account.
$ realm join --user=admin ipa.example.org
- You will be prompted for a password for the account.
- You will be prompted for Policy Kit authorization.
- On a successful join there will be no output.
- This can take up to a few minutes depending on how far away your FreeIPA domain is.
Expected Results
- Check that the domain is now configured.
$ realm list
- Make sure the domain is listed.
- Make sure you have a
configured: kerberos-member
line in the output. - Make note of the login-formats line for the next command.
- Check that you can resolve domain accounts on the local computer.
$ getent passwd 'admin@ipa.example.org'
- Make sure to use the quotes around the user name.
- You should see an output line that looks like passwd(5) output. It should contain an appropriate home directory, and a shell.
- Use the login-formats you saw above, to build a remote user name. It will be in the form of User@FULL-DOMAIN, where FULL-DOMAIN is your full IPA domain name (e.g. ipa.example.org).
- Check that you have an appropriate entry in your hosts keytab.
sudo klist -k
- You should see several lines, with your host name. For example
1 host/HOSTNAME@IPA.EXAMPLE.ORG
- Check that you can use your keytab with kerberos
sudo kinit -k 'host/HOSTNAME@IPA.EXAMPLE.ORG'
- Make sure to use quotes around the argument, because of the characters in there. Make sure the hostname and domain are capitalized.
- Use the principal from the output of the
klist
command above. Use the one that's capitalized and looks likehost/HOSTNAME@FULL-DOMAIN
. - There should be no output from this command.
- If you have set up the FreeIPA Web UI, you can use it to see that the computer account was created under the Hosts section.
Troubleshooting
Use the --verbose
argument to see details of what's being done during a join. Include verbose output in any bug reports.
$ realm join --verbose ipa.example.org
Known Issue [missing dependency]: realmd has a missing dependency: glib-networking. Please do:
# yum install glib-networking
The selinux profile for realmd isn't yet stable, so you may want turn off enforcement. Please do still file bugs for the SElinux AVC notifications you see.
Known Issue [Selinux]: You need to turn off selinux to complete the join. Please do:
$ sudo setenforce 0
Please file all realmd AVC's at this bug: https://bugzilla.redhat.com/show_bug.cgi?id=867873
$ sudo grep realmd /var/log/audit/audit.log