QA:Testcase realmd leave remove

From FedoraProject

(Difference between revisions)
Jump to: navigation, search
(Update requirements)
(Minor tweaks)
 
Line 17: Line 17:
 
# Perform the leave command.
 
# Perform the leave command.
 
#: <pre>$ realm leave --remove --user=User ad.example.com</pre>
 
#: <pre>$ realm leave --remove --user=User ad.example.com</pre>
#: You will be prompted for Policy Kit authorization.
+
#: You will be prompted for Policy Kit authorization, because you're not running as root.
 
#: You will be prompted for a password.
 
#: You will be prompted for a password.
 
#: This can take a minute or two depending on how far away you are from the directory.
 
#: This can take a minute or two depending on how far away you are from the directory.
Line 29: Line 29:
 
#: <pre>$ getent passwd 'AD\User'</pre>
 
#: <pre>$ getent passwd 'AD\User'</pre>
 
#: There should be no output.
 
#: There should be no output.
#: Use the <code>login-formats</code> you saw above, to build a remote user name. It will be in the form of <code>DOMAIN\User</code>, where DOMAIN is the first part of your full Active Directory domain name.
 
 
# Check that there is no machine account for the domain in the keytab.
 
# Check that there is no machine account for the domain in the keytab.
 
#: <pre>sudo klist -k</pre>
 
#: <pre>sudo klist -k</pre>

Latest revision as of 08:30, 9 May 2013

Contents

Description

Leave an active directory domain by removing the computer account, and then deconfiguring locally.

Setup

  1. Make sure you have other required software:
    • realmd 0.14.0 or later
  2. Verify that your Active Directory domain access works, or set a domain up.
  3. Run through the test case to join the domain.
  4. Verify that you are joined to the domain with the following command
    $ realm list
    Make sure you have a configured: kerberos-membership line in the output.
    Note the login-formats: line.
  5. Check that you can resolve domain accounts on the local computer.
    Use the login-formats you saw above, to build a remote user name. It will be in the form of DOMAIN\User, where DOMAIN is the first part of your full Active Directory domain name.
    $ getent passwd 'AD\User'

How to test

  1. Perform the leave command.
    $ realm leave --remove --user=User ad.example.com
    You will be prompted for Policy Kit authorization, because you're not running as root.
    You will be prompted for a password.
    This can take a minute or two depending on how far away you are from the directory.
    On a successful leave there will be no output.

Expected Results

  1. Check that the domain is no longer configured.
    $ realm list
    Make sure the domain is not listed.
  2. Check that you cannot resolve domain accounts on the local computer.
    $ getent passwd 'AD\User'
    There should be no output.
  3. Check that there is no machine account for the domain in the keytab.
    sudo klist -k
    You should see no lines referring to the domain in the table, or an error message saying that the keytab does not exist.
  4. If you have console access to a domain controller, you can use the Active Directory Users and Computers tool to see if that the computer account was deleted.



Troubleshooting

Use the --verbose argument to see details of what's being done during a leave. Include verbose output in any bug reports.

$ realm leave --remove --user=User --verbose ad.example.com