QA:Testcase FreeIPA realmd join
Join the current machine to a FreeIPA domain using GNOME's initial setup tool. Domain accounts are available on the local machine once this is done.
- This test case assumes you have already set up a FreeIPA domain (named "ipa.example.org" in this example - adjust as appropriate for your local configuration). If you haven't, you can set one up. QA:Testcase_freeipav3_installation can function as an instruction set for this purpose; also see the FreeIPA Guide.
- Your machine must have a fully-qualified host name. Do not proceed if the output of
localhost.localdomainor similar. It should be something like
- Make sure you have realmd-0.13.3-2 or later installed:
rpm -q realmd
How to test
- Perform the join command using IPA's admin account.
$ realm join --user=admin ipa.example.org
- You will be prompted for a password for the account.
- You will be prompted for Policy Kit authorization.
- On a successful join there will be no output.
- This can take up to a few minutes depending on how far away your FreeIPA domain is.
- Check that the domain is now configured.
$ realm list
- Make sure the domain is listed.
- Make sure you have a
configured: kerberos-memberline in the output.
- Make note of the login-formats line for the next command.
- Check that you can resolve domain accounts on the local computer.
$ getent passwd email@example.com
- You should see an output line that looks like passwd(5) output. It should contain an appropriate home directory, and a shell.
- Use the login-formats you saw above, to build a remote user name. It will be in the form of $user@$fqdn, where fqdn is your fully qualified IPA domain name (e.g. ipa.example.org).
- Check that you have an appropriate entry in your hosts keytab.
sudo klist -k
- You should see several lines, with your host name. For example
- Check that you can use your keytab with kerberos
sudo kinit -k host/client.ipa.example.org@IPA.EXAMPLE.ORG
- Make sure the domain name is capitalized.
- Use the principal from the output of the
klistcommand above. Use the one that's capitalized and looks like
- There should be no output from this command.
- If you have set up the FreeIPA Web UI, you can use it to see that the computer account was created under the Hosts section.
--verbose argument to see details of what's being done during a join. Include verbose output in any bug reports.
$ realm join --verbose ipa.example.org