QA:Testcase adcli join nodns

From FedoraProject

(Difference between revisions)
Jump to: navigation, search
(Add about kinit)
(kinit won't work)
Line 57: Line 57:
 
</pre>
 
</pre>
 
}}
 
}}
 
You should be able to authenticate using the keytab. You should not be prompted for a password, and no error message, when you run this command:
 
 
<pre>
 
# kinit -k 'COMPUTER$@DOMAIN.EXAMPLE.COM'
 
</pre>
 
  
 
=== More: No domain specified ===
 
=== More: No domain specified ===
Line 72: Line 66:
 
== Troubleshooting ==
 
== Troubleshooting ==
  
 +
* You won't be able to use kinit to authenticate against the domain at this point, as that requires either DNS or custom configuration.
 
* Move your <code>resolv.conf</code> back:
 
* Move your <code>resolv.conf</code> back:
 
<pre># mv /etc/resolv.conf.bak /etc/resolv.conf</pre>
 
<pre># mv /etc/resolv.conf.bak /etc/resolv.conf</pre>
 
* Use the <code>--verbose</code> argument to provide output when troubleshooting or reporting bugs.
 
* Use the <code>--verbose</code> argument to provide output when troubleshooting or reporting bugs.
* In the <code>kinit</code> line above, make sure you have the dollar sign, are using the short computer name, and have everything capitalized as expected.
+
 
  
 
[[Category:Active_Directory_Test_Cases]]
 
[[Category:Active_Directory_Test_Cases]]

Revision as of 08:16, 10 April 2013

Contents

Description

This test case verifies that adcli join can work without DNS.

Setup

  1. Make sure to complete the prerequisites before starting this test.
  2. Test general adcli info functionality before doing this test.
  3. Your machine should have a valid unique host name. It shouldn't be localhost.
  4. You need a domain account that is capable of joining the domain, for example an administrative account.
  5. These commands are meant to be run as root.
  6. You need the IP address of a domain controller for your domain. Find it like so:
    $ adcli info domain.example.com | grep domain-controller
    $ nslookup <domain-controller-from-previous-command>

How to test

  1. Remove your host keytab
    # test -e /etc/krb5.keytab && mv /etc/krb5.keytab /etc/krb5.keytab.bak
  2. Move your resolv.conf file to completely break DNS resolution.
    # mv /etc/resolv.conf /etc/resolv.conf.bak
  3. Use adcli to join the domain, placing your domain controller IP address in the appropriate place:
    # adcli join --login-user=Administrator --domain-controller=10.10.10.10 domain.example.com

Expected Results

The join command should prompt for a password and then complete without error.

The join command will take a few seconds. It can take up to a minute in extreme cases where the domain controller for the domain is far away (latency wise).

The host keytab should contain new credentials for the host, like this. The KVNO, computer name, and domain name will differ.

# klist -k
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- --------------------------------------------------------------------------
   3 COMPUTER$@DOMAIN.EXAMPLE.COM
   3 COMPUTER$@DOMAIN.EXAMPLE.COM
   3 COMPUTER$@DOMAIN.EXAMPLE.COM
   3 COMPUTER$@DOMAIN.EXAMPLE.COM
   3 COMPUTER$@DOMAIN.EXAMPLE.COM
   3 HOST/COMPUTER@DOMAIN.EXAMPLE.COM
   3 HOST/COMPUTER@DOMAIN.EXAMPLE.COM
   3 HOST/COMPUTER@DOMAIN.EXAMPLE.COM
   3 HOST/COMPUTER@DOMAIN.EXAMPLE.COM
   3 HOST/COMPUTER@DOMAIN.EXAMPLE.COM
   3 HOST/computer.example.com@DOMAIN.EXAMPLE.COM
   3 HOST/computer.example.com@DOMAIN.EXAMPLE.COM
   3 HOST/computer.example.com@DOMAIN.EXAMPLE.COM
   3 HOST/computer.example.com@DOMAIN.EXAMPLE.COM
   3 HOST/computer.example.com@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/COMPUTER@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/COMPUTER@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/COMPUTER@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/COMPUTER@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/COMPUTER@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/computer.example.com@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/computer.example.com@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/computer.example.com@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/computer.example.com@DOMAIN.EXAMPLE.COM
   3 RestrictedKrbHost/computer.example.com@DOMAIN.EXAMPLE.COM



More: No domain specified

  • You should be able to do the above without specifying a domain.
# adcli join --login-user=Administrator --domain-controller=10.10.10.10
  • In practice (real world) always know the domains you're joining.

Troubleshooting

  • You won't be able to use kinit to authenticate against the domain at this point, as that requires either DNS or custom configuration.
  • Move your resolv.conf back:
# mv /etc/resolv.conf.bak /etc/resolv.conf
  • Use the --verbose argument to provide output when troubleshooting or reporting bugs.