Bug 1258488 - Join to AD with adcli and defined computer-ou fails
Join to AD with adcli and defined computer-ou fails
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: realmd (Show other bugs)
Unspecified Unspecified
medium Severity medium
: rc
: ---
Assigned To: Sumit Bose
Patrik Kis
Depends On:
  Show dependency treegraph
Reported: 2015-08-31 09:28 EDT by Patrik Kis
Modified: 2016-11-04 03:46 EDT (History)
6 users (show)

See Also:
Fixed In Version: realmd-0.16.1-6.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2016-11-04 03:46:26 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Patrik Kis 2015-08-31 09:28:33 EDT
Description of problem:
Not sure if this is adlci or realmd issue, but I have an impression that adcli does not fully support this option. So either it should be implemented/fixed in adcli or prevent realmd to use predeficed computer-ou and adcli for join.

Version-Release number of selected component (if applicable):
but the old realmd-0.14.6-6.el7 has this issue too

How reproducible:

Steps to Reproduce:
echo -n <password> | adcli join --verbose --domain <ad_domain> --domain-realm <AD_REALM> --domain-controller <ad_ip> --login-type user --login-user <login_user> --computer-ou OU=<OU> --stdin-password

Actual results:


 ! Couldn't lookup computer container: 000020D6: SvcErr: DSID-031007DB, problem 5012 (DIR_ERROR), data 0

adcli: joining domain ad.baseos.qe failed: Couldn't lookup computer container: 000020D6: SvcErr: DSID-031007DB, problem 5012 (DIR_ERROR), data 

if the computer record does not exist in AD at all, or if it exists then the following error is displayed:

adcli: joining domain <ad_domain> failed: The computer account <machine_hostname> already exists, but is not in the desired organizational unit.
Comment 2 Patrik Kis 2015-08-31 09:32:10 EDT
NOTE, that in realmd-0.16.1-3.el7 adcli become the default membership software so this issue might be more visible.
Changing the target release to RHEL-7.2, but leave the decision to fix/postpone to devel as the issue is not that critical and have a en easy workaround (--membership-software=samba).
Comment 5 Stef Walter 2015-09-07 07:09:21 EDT
The adcli command line is incorrect. The adcli documentation states:

       -O, --domain-ou=OU=xxx
           The full distinguished name of the OU in which to create the computer
           account. If not specified then the computer account will be
           created in a default location.

In other words, an argument like OU=TestOU is an incomplete OU. If you are driving adcli directly, please specify the full OU, like this: OU=TestOU,DC=example,DC=com
Comment 6 Stef Walter 2015-09-07 07:14:20 EDT
So workaround for this is to specify a full DN to the realm client --computer-ou command.

So I think this is a realmd bug. It should perform the qualification automatically before handing it off to adcli.
Comment 17 lejeczek 2016-05-12 08:57:40 EDT
it would be nice to have it fixed, more than half a year later and admins still bog down there.
Comment 21 errata-xmlrpc 2016-11-04 03:46:26 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.