[Authentication] realmd erroneously reports "already joined" if /etc/sssd/sssd.conf is pre-present.

[Niklas Andersson]

Sorry Stef. Python is as far as I dare to go :-)

Regards,
Niklas

On 19/11/15 13:25, Stef Walter wrote:
> On 19.11.2015 13:19, Niklas Andersson wrote:
>> Hi Stef,
>>
>>   Well, yes. At least the join started when I commented out the #domains
>> , but then I got this error during the join:
>>
>>   ! Failed to enroll machine in realm: Already have domain openforce.org
>> in sssd.conf config file.
> Lets fix this bug, then your use case will work. Are you interested in
> contributing a fix? The code is here:
>
> http://cgit.freedesktop.org/realmd/realmd/tree/service/realm-sssd-config.c
>
> I think we need to add a boolean 'merge' argument to
> realm_sssd_config_add_domain() which when set appends to the domain
> section, rather than replacing it.
>
> And we would set that flag here:
>
> http://cgit.freedesktop.org/realmd/realmd/tree/service/realm-sssd-ad.c#n188
>
> Stef
>
>>   Being able to not start sssd per default (as an option perhaps), would
>> solve the problem, because that would give the admin some time to
>> customize sssd.conf before service is started.
>>
>> Regards,
>> Niklas
>>
>>
>>
>>
>> On 19/11/15 13:09, Stef Walter wrote:
>>> On 19.11.2015 13:06, Stephen Gallagher wrote:
>>>>> On Nov 19, 2015, at 7:01 AM, Stef Walter <stefw at gnome.org> wrote:
>>>>>
>>>>>> On 19.11.2015 12:51, Niklas Andersson wrote: Well,
>>>>>>
>>>>>> I want to add support for sudo in ldap for example, and
>>>>>> ignore_group_members, set some pam stuff. Paste the sssd.conf
>>>>>> here below.
>>>>> When asked to configure sssd (the default) realmd uses sssd.conf as
>>>>> the authoritative source of 'which domains am I joined to?'
>>>>> information.
>>>>>
>>>>> I wonder if there's a present-but-disabled setting in sssd.conf
>>>>> that could be useful in this case?
>>>>>
>>>> The domains= line in the [SSSD] section is the authoritative list of
>>>> enabled domains. All other domain sections are ignored.
>>> Niklas, does it work to include the new appropriately named section, but
>>> leave the domain name out of the domains= line? Will realmd then update
>>> the domains line, and further populate the [openforce.org] section?
>>>
>>> Stef
>>>
>>>>> Stef
>>>>>
>>>>>> [sssd] domains = openforce.org config_file_version = 2 services =
>>>>>> nss, pam, ssh, sudo
>>>>>>
>>>>>> [ssh]
>>>>>>
>>>>>> [sudo]
>>>>>>
>>>>>> [pam] offline_credentials_expiration = 60
>>>>>> pam_pwd_expiration_warning = 14
>>>>>>
>>>>>> [nss]
>>>>>>
>>>>>> [domain/openforce.org] id_provider = ad sudo_provider = ldap
>>>>>> ignore_group_members = true dyndns_update = false
>>>>>> use_fully_qualified_names = False lookup_family_order =
>>>>>> ipv4_only cache_credentials = True fallback_homedir = /home/%u
>>>>>> create_homedir = True override_shell = /bin/bash # # Sudo #
>>>>>> ldap_uri = ldap://srv11.openforce.org ldap_sudo_search_base =
>>>>>> ou=SUDOers,dc=openforce,dc=org ldap_default_bind_dn =
>>>>>> cn=admin,dc=openforce,dc=org ldap_default_authtok = secret
>>>>>>
>>>>>> Regards, Niklas
>>>>>>
>>>>>>> On 19/11/15 12:47, Stephen Gallagher wrote:
>>>>>>>
>>>>>>>> On Nov 19, 2015, at 6:35 AM, Niklas Andersson
>>>>>>>> <niklas.andersson at openforce.se> wrote:
>>>>>>>>
>>>>>>>> Hi,
>>>>>>>>
>>>>>>>> I just run into an oddity with realmd. It seams that if there
>>>>>>>> already is a preconfigured /etc/sssd/sssd.conf present, realm
>>>>>>>> will erroneously report that the client is already joined to
>>>>>>>> a domain.
>>>>>>>>
>>>>>>>> The thing is that I want to tweak the sssd.conf for our
>>>>>>>> domain before sssd is started, and it seems like I can't do
>>>>>>>> that because:
>>>>>>>>
>>>>>>>> a) If I pre-configure /etc/sssd/sssd.conf, realm won't join.
>>>>>>>>
>>>>>>>> b) If I don't pre-configure realm automatically generates a
>>>>>>>> default /etc/sssd/sssd.conf and starts the service right
>>>>>>>> after that.
>>>>>>>>
>>>>>>>> Is there somehow I can fix this nicely?
>>>>>>>>
>>>>>>> Could you specify what tweaks in particular that you are trying
>>>>>>> to apply?
>>>>> _______________________________________________ Authentication
>>>>> mailing list Authentication at lists.freedesktop.org
>>>>> http://lists.freedesktop.org/mailman/listinfo/authentication
>>>> _______________________________________________ Authentication
>>>> mailing list Authentication at lists.freedesktop.org
>>>> http://lists.freedesktop.org/mailman/listinfo/authentication
>>>>
>>> _______________________________________________
>>> Authentication mailing list
>>> Authentication at lists.freedesktop.org
>>> http://lists.freedesktop.org/mailman/listinfo/authentication
>> _______________________________________________
>> Authentication mailing list
>> Authentication at lists.freedesktop.org
>> http://lists.freedesktop.org/mailman/listinfo/authentication
> _______________________________________________
> Authentication mailing list
> Authentication at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/authentication