Red Hat Bugzilla – Bug 1258488
Join to AD with adcli and defined computer-ou fails
Last modified: 2016-11-04 03:46:26 EDT
Description of problem:
Not sure if this is adlci or realmd issue, but I have an impression that adcli does not fully support this option. So either it should be implemented/fixed in adcli or prevent realmd to use predeficed computer-ou and adcli for join.
Version-Release number of selected component (if applicable):
but the old realmd-0.14.6-6.el7 has this issue too
Steps to Reproduce:
echo -n <password> | adcli join --verbose --domain <ad_domain> --domain-realm <AD_REALM> --domain-controller <ad_ip> --login-type user --login-user <login_user> --computer-ou OU=<OU> --stdin-password
! Couldn't lookup computer container: 000020D6: SvcErr: DSID-031007DB, problem 5012 (DIR_ERROR), data 0
adcli: joining domain ad.baseos.qe failed: Couldn't lookup computer container: 000020D6: SvcErr: DSID-031007DB, problem 5012 (DIR_ERROR), data
if the computer record does not exist in AD at all, or if it exists then the following error is displayed:
adcli: joining domain <ad_domain> failed: The computer account <machine_hostname> already exists, but is not in the desired organizational unit.
NOTE, that in realmd-0.16.1-3.el7 adcli become the default membership software so this issue might be more visible.
Changing the target release to RHEL-7.2, but leave the decision to fix/postpone to devel as the issue is not that critical and have a en easy workaround (--membership-software=samba).
The adcli command line is incorrect. The adcli documentation states:
The full distinguished name of the OU in which to create the computer
account. If not specified then the computer account will be
created in a default location.
In other words, an argument like OU=TestOU is an incomplete OU. If you are driving adcli directly, please specify the full OU, like this: OU=TestOU,DC=example,DC=com
So workaround for this is to specify a full DN to the realm client --computer-ou command.
So I think this is a realmd bug. It should perform the qualification automatically before handing it off to adcli.
Fixed upstream here: http://cgit.freedesktop.org/realmd/realmd/commit/?id=3db35ad73ec57c8af499a0dcef96ffd4da914236
it would be nice to have it fixed, more than half a year later and admins still bog down there.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.