QA:Testcase realmd leave remove

Description

Leave an active directory domain by removing the computer account, and then deconfiguring locally.

Setup

1. Make sure you have other required software:
   • realmd 0.14.0 or later
2. Verify that your Active Directory domain access works, or set a domain up.
3. Run through the test case to join the domain.
4. Verify that you are joined to the domain with the following command

   $ realm list

   Make sure you have a configured: kerberos-membership line in the output.

   Note the login-formats: line.

5. Check that you can resolve domain accounts on the local computer.

   Use the login-formats you saw above, to build a remote user name. It will be in the form of DOMAIN\User, where DOMAIN is the first part of your full Active Directory domain name.

   $ getent passwd 'AD\User'

How to test

1. Perform the leave command.

   $ realm leave --remove --user=User ad.example.com

   You will be prompted for Policy Kit authorization, because you're not running as root.

   You will be prompted for a password.

   This can take a minute or two depending on how far away you are from the directory.

   On a successful leave there will be no output.

Expected Results

1. Check that the domain is no longer configured.

   $ realm list

   Make sure the domain is not listed.

2. Check that you cannot resolve domain accounts on the local computer.

   $ getent passwd 'AD\User'

   There should be no output.

3. Check that there is no machine account for the domain in the keytab.

   sudo klist -k

   You should see no lines referring to the domain in the table, or an error message saying that the keytab does not exist.

4. If you have console access to a domain controller, you can use the Active Directory Users and Computers tool to see if that the computer account was deleted.

Troubleshooting

Use the --verbose argument to see details of what's being done during a leave. Include verbose output in any bug reports.

$ realm leave --remove --user=User --verbose ad.example.com