Description of problem:


In a hardened AD environment, what AD Permissions required to join Linux computer to domain using realmd with samba.


Version-Release number of selected component (if applicable):


How reproducible:


# realm join DOMAIN.FQDN --membership-software=samba --user=SERVICEACCOUNT -v
 * Resolving: _ldap._tcp.domain.fqdn
 * Performing LDAP DSE lookup on: XXX.XXX.XXX.XXX
 * Performing LDAP DSE lookup on: XXX.XXX.XXX.XXX
 * Successfully discovered: domain.fqdn
Password for serviceaccount:
 * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net
 * LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.KY1RLZ -U serviceaccount ads join domain.fqdn createcomputer=Folder/Subfolder1/Subfolder2 osName=RedHat osVer=7
Enter serviceaccount's password:
Failed to join domain: failed to join domain 'domain.fqdn' over rpc: {Access Denied} A process has requested access to an object but has not been granted those access rights.
 ! Joining the domain domain.fqdn failed
realm: Couldn't join realm: Joining the domain domain.fqdn failed



Steps to Reproduce:
1.
2.
3.

Actual results:


Failed to join domain: failed to join domain 'domain.fqdn' over rpc: {Access Denied} A process has requested access to an object but has not been granted those access rights.


Expected results:


Additional info:


The service account has the following permissions in AD:

* Create/Delete computer objects
* Reset password (computer objects)
* Validated write to DNS host name (computer objects)
* Validated write to service principal name (computer objects)
* Read/Write all properties (computer objects)