2012-10-18 Active Directory

Fedora Test Days

Active Directory

Date	2012-10-18
Time	all day

Website	QA/Fedora_18_test_days
IRC	#fedora-test-day (webirc)
Mailing list	sssd-devel

Can't make the date?
If you come to this page before or after the test day is completed, your testing is still valuable, and you can use the information on this page to test, file any bugs you find at Bugzilla, and add your results to the results section. If this page is more than a month old when you arrive here, please check the current schedule and see if a similar but more recent Test Day is planned or has already happened.

What to test?

Today's installment of Fedora Test Day will focus on Active Directory, in particular using realmd to setup authentication using domain accounts, sssd to handle the active directory authentication, and other involved bits and pieces.

Who's available

The following cast of characters will be available testing, workarounds, bug fixes, and general discussion ...

Development - Stefw (stefw), jhrozek (jhrozek-SSSD devel)(irc_nick2)
Quality Assurance - ksrot (ksrot), omoris (omoris), mvadkert (mvadkert), jpospisi (jpospisi)

Prerequisite for Test Day

You need the following before joining in on the test day.

Live CD: http://fedorapeople.org/~stefw/isos/ad-testday-dns-20121018.iso
This Live CD is preconfigured to work with the Active Directory Test Bed. But you still need to set a local host name.
If you don't want to use the Live CD, you can use an updated Fedora 18 pre-release
realmd 0.10 installed from updates-testing, or from git master (preinstalled on the LiveCD).
An Active Directory domain to test against.
Domain user account or administrator account on the given Active Directory domain. See below for which test cases require which privileges.

How to test?

At a high level the following are being tested:

realmd used together with Active Directory
sssd used together with Active Directory
control-center GNOME control center used with Enterprise Logins
gnome-online-accounts used with a Kerberos account
gvfs used for SMB access with a Kerberos ticket

You can explore these, and their documentation. Or you can follow the test cases below.

Test Cases

Testcase	Description	Privileges	Approx. time required
AD no krb5.conf	Using Active Directory without krb5.conf	Any	5 minutes
Discover AD	Using realmd to discover information about an Active Directory domain	Any	5 minutes
Join AD with sssd	Using realmd to join an Active Directory domain with sssd as the client.	Domain user	15 minutes
Leave AD	Using realmd to leave an Active Directory domain.	Domain user	15 minutes
Leave AD with remove	Using realmd to leave an Active Directory domain, removing the computer account.	Domain user	15 minutes
Join AD with winbind	Using realmd to join an Active Directory domain with winbind as the client.	Domain user	15 minutes
Login with AD account	Using realmd permit one domain login, and then log in using that account	Domain user	10 minutes
Deny login for AD account	Using realmd deny one domain login.	Domain user	10 minutes
Login with any AD account	Using realmd permit any domain login, and then log in using an account	Domain user	10 minutes
Deny login for any AD account	Using realmd deny any domain login.	Domain user	10 minutes
Join AD automatic	Using realmd to join an active directory domain automatically	Domain admin	20 minutes
Join AD with OTP	Using realmd to join an Active Directory domain with a one time password.	Domain admin	20 minutes
Control Center Enterprise Login	Using Control Center to add an Enterprise Login (ie: a domain account), and testing login with that account.	Domain user	20 minutes
GVfs access	Using gvfs to access SMB shares with active kerberos ticket.	Domain user	5 minutes

Test Results

Log issues and enhancements in one of these places:

User	AD no krb5.conf	AD discovery	SSSD join	Leave AD	Leave AD and remove account	winbind join	login	deny login	permit any	deny any	autojoin	OTP join	control center	gvfsd-smb	References
Sample User	none	pass	warn ^[1]	fail ^[2]	none	none	none	none	none	none	none	none	none	none	↑ Test pass, RHBZ #54321 ↑ RHBZ #12345
mvadkert	pass	pass	fail ^[1] - realm crashes when computer-ou empty, ^[2], ^[3]	fail ^[4], works with disabled SELinux	fail ^[5], works with disabled SELinux	none	none	none	none	none	none	none	none	none	↑ RHBZ #867820 ↑ RHBZ #867767 - SELinux denials ↑ RHBZ #867769 - man page typo ↑ RHBZ #867767 - SELinux denials preventing sssd to stop ↑ RHBZ #867767 - SELinux denials preventing sssd to stop
Maxim Burgerhout	pass	pass	fail ^[1]	fail ^[2]	fail ^[3]	fail ^[4]	warn ^[5]	pass ^[6]	pass ^[7]	pass ^[8]	pass ^[9]	pass ^[10]	none	pass	↑ RHBZ #867765; works without SELinux ↑ same ↑ same ↑ Join works, but samba-client and samba-winbind packages are not installed RHBZ #867873 ↑ Works, but group names are not resolved RHBZ #867874 ↑ setenforce 0 ↑ setenforce 0 ↑ setenforce 0 ↑ setenforce 0 ↑ setenforce 0
omoris	pass	pass	none	none	none	none	none	none	none	none	none	none	none	none
Stijn	pass	pass	fail ^[1]	warn ^[2]	warn ^[3]	warn ^[4]	warn ^[5]	pass ^[6]	pass ^[7]	pass ^[8]	none	none	none	none	↑ AVC denials (RHBZ #867765), incorrect DNS registration (RHBZ #867864, RHBZ #867915), works with setenforce 0 ↑ AVC denials (RHBZ #867765), works with setenforce 0 ↑ AVC denials (RHBZ #867765), works with setenforce 0 ↑ with workaroud (RHBZ #867873) tests pass, winbind warns about log file (RHBZ #867893) ↑ Works, but groups are not resolved RHBZ #867874 ↑ with setenforce 0, I did not check audit logs ↑ with setenforce 0, I did not check audit logs ↑ with setenforce 0, I did not check audit logs
stefw	pass	pass	fail ^[1]	warn ^[2]	warn ^[3]	fail ^[4]	warn ^[5]	warn ^[6]	warn ^[5]	warn ^[7]	fail ^[8]	warn ^[9]	fail ^[10]	pass	↑ RHBZ #867767 ↑ with setenforce 0 ↑ with setenforce 0 ↑ RHBZ #867873 ↑ ^5.0 ^5.1 RHBZ #867874 ↑ https://bugzilla.gnome.org/show_bug.cgi?id=686385 ↑ https://bugs.freedesktop.org/show_bug.cgi?id=56144 ↑ https://bugs.freedesktop.org/show_bug.cgi?id=56147 https://bugs.freedesktop.org/show_bug.cgi?id=56148 ↑ https://bugs.freedesktop.org/show_bug.cgi?id=56147 ↑ https://bugzilla.gnome.org/show_bug.cgi?id=686390
jpospisi	pass	pass	warn ^[1]	pass	pass ^[2]	warn ^[3]	none	none	none	none	none	none	none	none	↑ RHBZ #867873 all testcases past this one were tested with 'setenforce 0' ↑ I had access to the server. Checked that computer was successfully removed. ↑ RHBZ #867873
ksrot	pass	warn ^[1]	fail ^[2] ^[3]	fail ^[2]	fail ^[4]	none	none	none	none	none	none	none	none	none	none ↑ RHBZ #867767 ↑ ^2.0 ^2.1 RHBZ #867765 ↑ RHBZ #867807 ↑ RHBZ #867873
jscotka	pass	pass	fail ^[1]	pass	pass	pass but seems slow	none	none	none	none	none	none	none	none	none ↑ RHBZ #867873
psklenar	pass	fail ^[1]	none	none	none	none	none	none	none	none	none	none	none	none	none ↑ RHBZ #867820
tbzatek	pass	pass	warn ^[1]	warn ^[1]	pass	pass	pass	pass	pass	pass	pass	pass	pass	none	none ↑ ^1.0 ^1.1 RHBZ #867767
pkis	pass	pass	none	none	none	none	none	none	none	none	none	none	none	none
Adam Joseph Cook	pass	pass	warn ^[1] ^[2]	warn ^[3]	warn ^[4]	warn ^[5]	warn ^[6] ^[7] ^[8]	inprogress ^[9]	inprogress	inprogress	inprogress	inprogress	inprogress	inprogress	↑ RHBZ #867873 ↑ Disabled SELinux (setenforce 0). Step 4 may be incorrect - system had to restarted to find keytab. ↑ Disabled SELinux (setenforce 0) - will not pass otherwise. ↑ Disabled SELinux (setenforce 0) - will not pass otherwise. ↑ Disabled SELinux (setenforce 0) - will not pass otherwise. ↑ RHBZ #825498 ↑ RHBZ #867874 ↑ Disabled SELinux (setenforce 0) - will not pass otherwise. ↑ Had to suspend testing, significant nouveau issues with FC18 - not related to AD. Will finish in coming days.
vpodzime (all with setenforce 0)	pass	pass	pass	pass	warn ^[1]	pass	pass	pass	pass	pass	pass ^[2]	pass	pass ^[3]	pass	↑ Computer not removed from the Active Directory, only a liitle arrow appeared in the computer icon screenshot ↑ Some problems appeared during testing, but were caused by the leftovers from the previous testing. ↑ The user was listed in the GDM's list.

[1] Test pass, RHBZ #54321

[2] RHBZ #12345

[bz867820-3] RHBZ #867820

[4] RHBZ #867767 - SELinux denials

[5] RHBZ #867769 - man page typo

[6] RHBZ #867767 - SELinux denials preventing sssd to stop

[7] RHBZ #867767 - SELinux denials preventing sssd to stop

[8] RHBZ #867765; works without SELinux

[9] same

[10] same

[11] Join works, but samba-client and samba-winbind packages are not installed RHBZ #867873

[12] Works, but group names are not resolved RHBZ #867874

[13] setenforce 0

[14] setenforce 0

[15] setenforce 0

[16] setenforce 0

[17] setenforce 0

[18] AVC denials (RHBZ #867765), incorrect DNS registration (RHBZ #867864, RHBZ #867915), works with setenforce 0

[19] AVC denials (RHBZ #867765), works with setenforce 0

[20] AVC denials (RHBZ #867765), works with setenforce 0

[21] with workaroud (RHBZ #867873) tests pass, winbind warns about log file (RHBZ #867893)

[22] Works, but groups are not resolved RHBZ #867874

[23] with setenforce 0, I did not check audit logs

[24] with setenforce 0, I did not check audit logs

[25] with setenforce 0, I did not check audit logs

[bz867767-26] RHBZ #867767

[27] with setenforce 0

[28] with setenforce 0

[bz867873-29] RHBZ #867873

[bz867874-30] 5.0 ^5.1 RHBZ #867874

[31] ttps://bugzilla.gnome.org/show_bug.cgi?id=686385

[32] ttps://bugs.freedesktop.org/show_bug.cgi?id=56144

[33] ttps://bugs.freedesktop.org/show_bug.cgi?id=56147 https://bugs.freedesktop.org/show_bug.cgi?id=56148

[34] ttps://bugs.freedesktop.org/show_bug.cgi?id=56147

[35] ttps://bugzilla.gnome.org/show_bug.cgi?id=686390

[36] RHBZ #867873 all testcases past this one were tested with 'setenforce 0'

[37] I had access to the server. Checked that computer was successfully removed.

[bz867873-38] RHBZ #867873

[bz867767-39] RHBZ #867767

[bz867765-40] 2.0 ^2.1 RHBZ #867765

[bz867807-41] RHBZ #867807

[bz867873-42] RHBZ #867873

[bz867873-43] RHBZ #867873

[bz867820-44] RHBZ #867820

[bz867767-45] 1.0 ^1.1 RHBZ #867767

[1]

[2]

[1]

[2]

[3]

[4]

[5]

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[10]

[1]

[2]

[3]

[1]

[2]

[3]

[4]

[1]

[1]

[1]

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

[1]

[2]

[3]

Search

Test Day:2012-10-18 Active Directory

Contents