From Fedora Project Wiki

(Should test with kinit.)
(Add about OU)
Line 7: Line 7:
# Your machine should have a valid unique host name. It shouldn't be <code>localhost</code>.
# Your machine should have a valid unique host name. It shouldn't be <code>localhost</code>.
# You need a domain account that is capable of joining the domain, for example an administrative account.
# You need a domain account that is capable of joining the domain, for example an administrative account.
# These commands should be run as root (see <em>More: Different keytab</em> below for an alternative).
#: If you only have write access to a specific OU in the domain, see <em>More: Organizational Unit</em> below for how to use that.
# These commands should be run as root.
#: See <em>More: Different keytab</em> below for an alternative.


|actions=
|actions=
Line 70: Line 72:


* Use the <code>--host-fqdn</code> and <code>--computer-name</code> to specify a different computer account name than what is available through <code>gethostname()</code>.
* Use the <code>--host-fqdn</code> and <code>--computer-name</code> to specify a different computer account name than what is available through <code>gethostname()</code>.
<pre># adcli join --host-fqdn=different.example.com --computer-name=different domain.example.com</pre>
<pre># adcli join --host-fqdn=different.example.com \
        --computer-name=different domain.example.com</pre>
* The keytab thus created will use the specified names.
* The keytab thus created will use the specified names.


Line 76: Line 79:


* If you are unable to run the <code>adcli join</code> command as root, you can use the following a <code>--host-keytab=/tmp/krb5.keytab</code> argument to remove that requirement.  
* If you are unable to run the <code>adcli join</code> command as root, you can use the following a <code>--host-keytab=/tmp/krb5.keytab</code> argument to remove that requirement.  
<pre>$ adcli join --host-keytab=/tmp/krb5.keytab --login-user=Administrator domain.example.com</pre>
<pre>$ adcli join --host-keytab=/tmp/krb5.keytab \
        --login-user=Administrator domain.example.com</pre>
* If you do so, you should also set the environment variable <code>KRB5_KTNAME=/tmp/krb5.keytab</code> when checking the results.
* If you do so, you should also set the environment variable <code>KRB5_KTNAME=/tmp/krb5.keytab</code> when checking the results.
=== More: Organizational Unit ===
* To create the computer account in a specific Organizational Unit in the domain, use the <code>--domain-ou</code> option:
<pre># adcli join --domain-ou=OU=Testing,DC=domain,DC=example,DC=com \
        --login-user=Administrator domain.example.com</pre>


== Troubleshooting ==
== Troubleshooting ==

Revision as of 08:24, 10 April 2013

Description

This test case verifies that adcli join works with basic options.

Setup

  1. Make sure to complete the prerequisites before starting this test.
  2. It is necessary to have complete domain DNS resolution working for this test.
  3. Test general adcli info functionality before doing this test.
  4. Your machine should have a valid unique host name. It shouldn't be localhost.
  5. You need a domain account that is capable of joining the domain, for example an administrative account.
    If you only have write access to a specific OU in the domain, see More: Organizational Unit below for how to use that.
  6. These commands should be run as root.
    See More: Different keytab below for an alternative.

How to test

  1. Remove your host keytab
    # test -e /etc/krb5.keytab && mv /etc/krb5.keytab /etc/krb5.keytab.bak
  2. Use adcli to join the domain:
    # adcli join --login-user=Administrator domain.example.com

Expected Results

The join command should prompt for a password and then complete without error.

The join command will take a few seconds. It can take up to a minute in extreme cases where the domain controller for the domain is far away (latency wise).

The host keytab should contain new credentials for the host, like this. The KVNO, computer name, and domain name will differ.

# klist -k
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   3 COMPUTER$@DOMAIN.EXAMPLE.COM
   3 COMPUTER$@DOMAIN.EXAMPLE.COM
   3 COMPUTER$@DOMAIN.EXAMPLE.COM
   3 COMPUTER$@DOMAIN.EXAMPLE.COM
   3 COMPUTER$@DOMAIN.EXAMPLE.COM
   3 HOST/COMPUTER@DOMAIN.EXAMPLE.COM
   3 HOST/COMPUTER@DOMAIN.EXAMPLE.COM
   3 HOST/COMPUTER@DOMAIN.EXAMPLE.COM
   3 HOST/COMPUTER@DOMAIN.EXAMPLE.COM
   3 HOST/COMPUTER@DOMAIN.EXAMPLE.COM
   3 HOST/computer.example.com@DOMAIN.EXAMPLE.COM
   3 HOST/computer.example.com@DOMAIN.EXAMPLE.COM
   3 HOST/computer.example.com@DOMAIN.EXAMPLE.COM
   3 HOST/computer.example.com@DOMAIN.EXAMPLE.COM
   3 HOST/computer.example.com@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/COMPUTER@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/COMPUTER@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/COMPUTER@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/COMPUTER@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/COMPUTER@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/computer.example.com@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/computer.example.com@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/computer.example.com@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/computer.example.com@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/computer.example.com@DOMAIN.EXAMPLE.COM



You should be able to authenticate using the keytab. You should not be prompted for a password, and no error message, when you run this command:

# kinit -k 'COMPUTER$@DOMAIN.EXAMPLE.COM'

More: Use precached credentials

  • You should be able to precache your kerberos credentials, and use them to join a domain:
# kinit Administrator@DOMAIN.EXAMPLE.COM
# adcli join --login-ccache domain.example.com
  • You should not be prompted for a password a second time.

More: Different computer name

  • Use the --host-fqdn and --computer-name to specify a different computer account name than what is available through gethostname().
# adcli join --host-fqdn=different.example.com \
        --computer-name=different domain.example.com
  • The keytab thus created will use the specified names.

More: Different keytab

  • If you are unable to run the adcli join command as root, you can use the following a --host-keytab=/tmp/krb5.keytab argument to remove that requirement.
$ adcli join --host-keytab=/tmp/krb5.keytab \
        --login-user=Administrator domain.example.com
  • If you do so, you should also set the environment variable KRB5_KTNAME=/tmp/krb5.keytab when checking the results.

More: Organizational Unit

  • To create the computer account in a specific Organizational Unit in the domain, use the --domain-ou option:
# adcli join --domain-ou=OU=Testing,DC=domain,DC=example,DC=com \
        --login-user=Administrator domain.example.com

Troubleshooting

  • Use the --verbose argument to provide output when troubleshooting or reporting bugs.
  • In the kinit line above, make sure you have the dollar sign, are using the short computer name, and have everything capitalized as expected.