<div dir="ltr"><div>Well, that's handy to know, I'll have to read up on where I missed that sssd does the machine password resets. I probably don't have that version either, as I'm still on 1.9 in CentOS.</div>
<div> </div><div>But, based on that, I decided to give adcli a try instead of msktutil.</div><div> </div><div>adcli join --login-user=domain-admin --verbose --show-details --os-name=CentOS --os-version=6.5 --domain-ou='OU=Blah,OU=Blah2,OU=Blah3,OU=Blah4,OU=Blah5,DC=local,DC=parent,DC=organization,DC=corp'</div>
<div> </div><div>Values changed of course. </div><div> </div><div>I run into a SASL problem though. I'm assuming I'd need a new version. (seems to be the trend)</div><div> </div><div> ! Couldn't authenticate to active directory: SASL(-7): invalid parameter supplied: Unable to find a callback: 32775<br>
<br></div><div>I can join it via msktutil after doing a kinit domain-admin, which implies my krb5.conf and my ldap.conf are setup correctly (well, implies to me, if you haven't used msktutil, then probably not so much).</div>
<div> </div><div>Ignoring msktutil, ldapsearch works correctly.</div><div> </div><div>ldapsearch -H ldaps://server.fqdn:636/ -Y GSSAPI -N -b "dc=local,dc=parent,dc=organization,dc=corp" "(&(objectClass=user)(sAMAccountName=domain-admin))"</div>
<div> </div><div> </div><div> </div><div>Log:</div><div> * Calculated domain name from host fqdn: local.parent.organization.corp<br> * Calculated computer account name from fqdn: computername<br> * Calculated domain realm from name: LOCAL.PARENT.ORGANIZATION.CORP<br>
* Discovering domain controllers: _ldap._tcp.local.parent.organization.corp<br> * Sending cldap pings to domain controller: dc3.local.parent.organization.corp<br> * Sending cldap pings to domain controller: dc2.local.parent.organization.corp<br>
* Sending cldap pings to domain controller: dc1.local.parent.organization.corp<br> * Received NetLogon info from: DC3.local.parent.organization.corp<br> * Received NetLogon info from: DC2.local.parent.organization.corp<br>
* Wrote out krb5.conf snippet to /tmp/adcli-krb5-7KxlKP/krb5.d/adcli-krb5-conf-x2C2NA<br>Password for domain-admin@LOCAL.PARENT.ORGANIZATION.CORP:<br> * Authenticated as user: domain-admin@LOCAL.PARENT.ORGANIZATION.CORP<br>
! Couldn't authenticate to active directory: SASL(-7): invalid parameter supplied: Unable to find a callback: 32775<br>adcli: couldn't connect to local.parent.organization.corp domain: Couldn't authenticate to active directory: SASL(-7): invalid parameter supplied: Unable to find a callback: 32775<br>
</div><div> </div><div>Interestingly as well, I believe I should have received 3 messages for NetLogon info... or maybe the issue is a problem with my DC1.</div><div> </div><div>Thanks for any help,</div><div>Chris </div>
<div> </div><div> </div><div> </div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sun, Feb 23, 2014 at 10:43 PM, Stef Walter <span dir="ltr"><<a href="mailto:stefw@gnome.org" target="_blank">stefw@gnome.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On <a href="tel:24.02.2014%2007" value="+12402201407">24.02.2014 07</a>:18, Chris Gray wrote:<br>
> Has anyone been able to get realmd to work in CentOS 6.5? (or any<br>
> version for that matter)<br>
><br>
> Seems to require a newer glib2 and automake than CentOS ships with.<br>
><br>
> The basic reason I'm asking is due to people in the SSSD mailing list<br>
> telling me I should stop using msktutil and use realmd... which of<br>
> course is easier said than done.<br>
><br>
> I did notice while searching the list for other people asking the same<br>
> question, that you guys have an adcli program. I was able to install<br>
> that via epel. I could use that to do the joining instead of msktutil,<br>
> but then without realmd, how would the machine password be reset before<br>
> it expires? It seems that until I can either figure out all the<br>
> dependencies for realmd on centos, I'm stuck with msktutil.<br>
<br>
</div></div>realmd doesn't help reset the machine password. sssd does that in recent<br>
versions.<br>
<br>
realmd is just a wrapper for things like adcli, 'net join',<br>
ipa-client-install and so on. It also sets up sssd.conf. But you can do<br>
anything it can do with just adcli and sssd, and manual configuration.<br>
<br>
Stef<br>
<br>
_______________________________________________<br>
Authentication mailing list<br>
<a href="mailto:Authentication@lists.freedesktop.org">Authentication@lists.freedesktop.org</a><br>
<a href="http://lists.freedesktop.org/mailman/listinfo/authentication" target="_blank">http://lists.freedesktop.org/mailman/listinfo/authentication</a><br>
</blockquote></div><br><br clear="all"><br>-- <br>Intelligence is a matter of opinion.
</div>