Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
DescriptionMohammed Shakir Ali
2019-01-03 01:39:40 UTC
Description of problem:
In a hardened AD environment, what AD Permissions required to join Linux computer to domain using realmd with samba.
Version-Release number of selected component (if applicable):
How reproducible:
# realm join DOMAIN.FQDN --membership-software=samba --user=SERVICEACCOUNT -v
* Resolving: _ldap._tcp.domain.fqdn
* Performing LDAP DSE lookup on: XXX.XXX.XXX.XXX
* Performing LDAP DSE lookup on: XXX.XXX.XXX.XXX
* Successfully discovered: domain.fqdn
Password for serviceaccount:
* Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net
* LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.KY1RLZ -U serviceaccount ads join domain.fqdn createcomputer=Folder/Subfolder1/Subfolder2 osName=RedHat osVer=7
Enter serviceaccount's password:
Failed to join domain: failed to join domain 'domain.fqdn' over rpc: {Access Denied} A process has requested access to an object but has not been granted those access rights.
! Joining the domain domain.fqdn failed
realm: Couldn't join realm: Joining the domain domain.fqdn failed
Steps to Reproduce:
1.
2.
3.
Actual results:
Failed to join domain: failed to join domain 'domain.fqdn' over rpc: {Access Denied} A process has requested access to an object but has not been granted those access rights.
Expected results:
Additional info:
The service account has the following permissions in AD:
* Create/Delete computer objects
* Reset password (computer objects)
* Validated write to DNS host name (computer objects)
* Validated write to service principal name (computer objects)
* Read/Write all properties (computer objects)
Comment 31Andreas Schneider
2019-03-29 10:40:55 UTC
Comment 34Andreas Schneider
2019-04-04 13:16:51 UTC
I'm working on a fix. This is something we never supported in Samba so it needs quite a few code changes!
Comment 35Andreas Schneider
2019-04-10 07:38:55 UTC
I'm not sure if we will be able to address this in RHEL 7.7 as the Windows Protocol documentation doesn't document the implementation details. We are in contact with Microsoft to get this probably documented but they need time to investigate this.
Comment 37Andreas Schneider
2019-04-12 08:35:37 UTC
'net ads join' uses DCERPC to join the domain an setup the machine account. In order to do that over a sealed connection there are changes needed in Samba. We found that the Microsoft documentation in that area doesn't documented how to do that. Also there are differences between Windows versions.
You can follow the discussion with Microsoft here:
https://lists.samba.org/archive/cifs-protocol/2019-April/thread.html
Comment 40Andreas Schneider
2019-05-29 06:26:13 UTC
This is still under investigation and work in progress. Moving to RHEL 7.8.0.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHSA-2020:1084
Description of problem: In a hardened AD environment, what AD Permissions required to join Linux computer to domain using realmd with samba. Version-Release number of selected component (if applicable): How reproducible: # realm join DOMAIN.FQDN --membership-software=samba --user=SERVICEACCOUNT -v * Resolving: _ldap._tcp.domain.fqdn * Performing LDAP DSE lookup on: XXX.XXX.XXX.XXX * Performing LDAP DSE lookup on: XXX.XXX.XXX.XXX * Successfully discovered: domain.fqdn Password for serviceaccount: * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net * LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.KY1RLZ -U serviceaccount ads join domain.fqdn createcomputer=Folder/Subfolder1/Subfolder2 osName=RedHat osVer=7 Enter serviceaccount's password: Failed to join domain: failed to join domain 'domain.fqdn' over rpc: {Access Denied} A process has requested access to an object but has not been granted those access rights. ! Joining the domain domain.fqdn failed realm: Couldn't join realm: Joining the domain domain.fqdn failed Steps to Reproduce: 1. 2. 3. Actual results: Failed to join domain: failed to join domain 'domain.fqdn' over rpc: {Access Denied} A process has requested access to an object but has not been granted those access rights. Expected results: Additional info: The service account has the following permissions in AD: * Create/Delete computer objects * Reset password (computer objects) * Validated write to DNS host name (computer objects) * Validated write to service principal name (computer objects) * Read/Write all properties (computer objects)