Bug 874970

Summary:	adcli fails to join if computer account exists in domain, but wrong OU
Product:	[Fedora] Fedora	Reporter:	Stef Walter <stefw>
Component:	adcli	Assignee:	Stef Walter <stefw>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	18	CC:	stefw, yaneti
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-11-23 07:26:10 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	874450

Description Stef Walter 2012-11-09 08:15:39 UTC

Description of problem:

Got this today:

[stef@stef-rawhide realmd]$ sudo tools/realm join --verbose --no-password radi08.segad.lab.sjc.redhat.com
 * Searching for kerberos SRV records for domain: _kerberos._udp.radi08.segad.lab.sjc.redhat.com
 * Searching for MSDCS SRV records on domain: _kerberos._tcp.dc._msdcs.radi08.segad.lab.sjc.redhat.com
 * ad1.radi08.segad.lab.sjc.redhat.com:88 
 * Found kerberos DNS records for: radi08.segad.lab.sjc.redhat.com
 * Found AD style DNS records for: radi08.segad.lab.sjc.redhat.com
 * Successfully discovered: radi08.segad.lab.sjc.redhat.com
 * Assuming packages installed
 * LANG=C /usr/sbin/adcli join --verbose --show-details --domain RADI08.SEGAD.LAB.SJC.REDHAT.COM --login-type computer --no-password --computer-ou OU=Test Day, DC=radi08, DC=segad, DC=lab, DC=sjc, DC=redhat, DC=com
 * Using domain name: RADI08.SEGAD.LAB.SJC.REDHAT.COM
 * Calculated computer account name from fqdn: STEF-RAWHIDE
 * Calculated domain realm from name: RADI08.SEGAD.LAB.SJC.REDHAT.COM
 * Resolved LDAP urls from SRV record: _ldap._tcp.RADI08.SEGAD.LAB.SJC.REDHAT.COM: ldap://ad1.radi08.segad.lab.sjc.redhat.com:389
 * Authenticated as default/reset computer account: STEF-RAWHIDE
 * Looked up short domain name: RADI08
 * Using fully qualified name: stef-rawhide.thewalter.lan
 * Using domain name: RADI08.SEGAD.LAB.SJC.REDHAT.COM
 * Using computer account name: STEF-RAWHIDE
 * Using domain realm: RADI08.SEGAD.LAB.SJC.REDHAT.COM
 * Using LDAP urls: ldap://ad1.radi08.segad.lab.sjc.redhat.com:389
 * Enrolling computer account name calculated from fqdn: STEF-RAWHIDE
 * Generated 120 character computer password
 * Using keytab: FILE:/etc/krb5.keytab
 * Using fully qualified name: stef-rawhide.thewalter.lan
 * Using domain name: RADI08.SEGAD.LAB.SJC.REDHAT.COM
 * Using computer account name: STEF-RAWHIDE
 * Using domain realm: RADI08.SEGAD.LAB.SJC.REDHAT.COM
 * Using LDAP urls: ldap://ad1.radi08.segad.lab.sjc.redhat.com:389
 * Looked up short domain name: RADI08
 * The computer organizational unit is valid: OU=Test Day, DC=radi08, DC=segad, DC=lab, DC=sjc, DC=redhat, DC=com
 ! Couldn't find a computer container in the ou, creating computer account directly in: OU=Test Day, DC=radi08, DC=segad, DC=lab, DC=sjc, DC=redhat, DC=com
 * Calculated computer DN: CN=STEF-RAWHIDE,OU=Test Day, DC=radi08, DC=segad, DC=lab, DC=sjc, DC=redhat, DC=com
 * Creating computer account with attributes: objectClass, sAMAccountName, userAccountControl
 ! Couldn't create computer account: CN=STEF-RAWHIDE,OU=Test Day, DC=radi08, DC=segad, DC=lab, DC=sjc, DC=redhat, DC=com: 000020E7: AtrErr: DSID-03152CA2, #1:
	0: 000020E7: DSID-03152CA2, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 90008 (userAccountControl):len 4

adcli: enroll in RADI08.SEGAD.LAB.SJC.REDHAT.COM domain failed: Couldn't create computer account: CN=STEF-RAWHIDE,OU=Test Day, DC=radi08, DC=segad, DC=lab, DC=sjc, DC=redhat, DC=com: 000020E7: AtrErr: DSID-03152CA2, #1:
	0: 000020E7: DSID-03152CA2, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 90008 (userAccountControl):len 4

 ! Failed to join the domain
realm: Couldn't join realm: Failed to join the domain

The computer account existed under the CN=Computers, but adcli was trying to create it under OU=Test Day. We should detect this and handle it appropriately.

In addition if account is precreated under a different OU, and client doesn't care about OU, just respect where it was precreated.

Version-Release number of selected component (if applicable):

adcli 0.3

Comment 1 Fedora Update System 2012-11-12 14:29:06 UTC

adcli-0.4-1.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/adcli-0.4-1.fc18

Comment 2 Fedora Update System 2012-11-12 18:34:29 UTC

Package adcli-0.4-1.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing adcli-0.4-1.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-18051/adcli-0.4-1.fc18
then log in and leave karma (feedback).

Comment 3 Fedora Update System 2012-11-23 07:26:12 UTC

adcli-0.4-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.