Join the current machine to an Active Directory using OpenLMI
- We need to gather SELinux AVC's, be sure to gather all AVC's generated by this test case. See Troubleshooting section below
$ sudo setenforce 0
- Install the components
$ sudo yum install tog-pegasus pywbem realmd
- Download the realm CIM scriptlet
$ sudo wget -O /usr/local/bin/realmd-cim http://jdennis.fedorapeople.org/realmd-cim
- Make it executable
$ sudo chmod +x /usr/local/bin/realmd-cim
- Start the pgasus CIMOM
$ sudo systemctl start tog-pegasus.service
- Verify pegasus is running
$ sudo systemctl status tog-pegasus
- Make sure you have other required software:
- realmd 0.14.0 or later
- adcli 0.7 or later
- openlmi-providers 0.21 or later
$ sudo yum install realmd openlmi-providers openlmi-realmd
- Verify the OpenLMI Realmd provider is properly registered
$ sudo cimprovider -l
- If the previous command did not list cmpiLMI_Realmd register the provider manually
$ sudo openlmi-mof-register register /usr/share/openlmi-providers/60_LMI_Realmd.mof /usr/share/openlmi-providers/60_LMI_Realmd.reg
- Set the pegasus password, in this example we'll use XXXX as the password
$ sudo passwd pegasus
- Verify that your Active Directory domain access works, or set a domain up.
How to test
- Show joined domains
$ realm list $ realmd-cim -u pegasus -p XXXX list
realmd-cim should show equivalent information as to what
- Join a domain
$ realmd-cim -u pegasus -p XXXX join Administrator DomainPassword ad.example.com
- Check if you are joined to the domain
- The domain should be listed
- Make note of the login format
- Check that domain accounts can be resolved
getent passwd 'AD\User'
- Make sure to use the quotes around the user name.
- You should see an output line that looks like passwd(5) output. It should contain an appropriate home directory, and a shell.
- Use the login-formats you saw above, to build a remote user name. It will be in the form of DOMAIN\User, where DOMAIN is the first part of your full Active Directory domain name.
- Check that you have an appropriate entry in your hosts keytab.
sudo klist -k
- Check that you can use your keytab with kerberos
sudo kinit -k 'HOSTNAME$@AD.EXAMPLE.COM'
- Make sure to use quotes around the argument, because of the characters in there. #: Make sure the hostname and domain are capitalized.
- Use the principal from the output of the klist command above. Use the one that's capitalized and looks like HOSTNAME$@DOMAIN.
- There should be no output from this command.
- Try to log into the machine as a domain account at the console.
- This should automatically create a new home directory for the user, and log into a shell prompt.
More: Explore the realmd-cim script
realmd-cim --help to see how to leave a domain.
More: Try it with FreeIPA
Use a FreeIPA domain with the OpenLMI join.
- RHBZ #961207 When you see SELinux AVC's report them AVC's to this bug.
$ sudo setenforce permissive ... do the test $ sudo less /var/log/audit/audit.log