Open iamteedoh opened 10 years ago
Hey @unix4linux the class pbis should be automatically detected. Requirement for that is that the class folder is exactly called pbis.
This is an extract of my puppetmaster but updaded/changed/included things you need to insert (see comments) for your enterprise setup.
root@puppetmaster /etc/puppet # tree
.
[...]
├── manifests
│ ├── site.pp
├── modules
[...]
│ ├── pbis
│ │ ├── AUTHORS
│ │ ├── files
│ │ │ ├── pbis-enterprise.amd64.rpm
│ │ │ └── pbis-enterprise-upgrade.amd64.rpm
│ │ ├── lib
│ │ │ └── puppet
│ │ │ └── parser
│ │ │ └── functions
│ │ │ └── transform_ou.rb
│ │ ├── LICENSE
│ │ ├── manifests
│ │ │ ├── init.pp
│ │ │ └── params.pp
│ │ ├── Modulefile
│ │ ├── README.md
│ │ ├── templates
│ │ │ └── pbis.conf.erb
│ │ └── tests
│ │ └── init.pp
│ ├── my-implementation
│ └── manifests
│ └── init.pp
[...]
root@puppetmaster /etc/puppet # cat modules/my-implementation/manifests/init.pp
class my-implementation {
[...]
class { 'pbis':
ad_domain => 'DIRECTORY.XXXXXXXXXX.XX',
bind_username => 'domainjoin',
bind_password => 'XXXXXXX',
user_domain_prefix => 'DIRECTORY', # you may not need that
home_dir_template => '%H/%U', # you may not need that
login_shell_template => '/bin/zsh', # you may not need that
service_name => 'lwsmd',
package => 'pbis-enterprise', # your enterprise core package name
package_prerequired => 'pbis-enterprise-upgrade' # your enterprise upgrade package name
}
[...]
}
root@puppetmaster /etc/puppet # cat manifests/site.pp
[...]
node 'host.directory.XXXXXXX.XX' {
[...]
include my-implementation
}
[...]
While [...] is always a placeholder for other stuff you might have but it's not related to this issue.
But this should work seamlessly now if you adapt this correctly.
Hello @dionysius
Everything looks good but I am getting an error for the params.pp on line 41 as follows:
Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Function 'fail' does not return a value at /etc/puppetlabs/env/development/modules/pbis/manifests/params.pp:41
When I look at the params.pp file for that line, here is the output (as expected from cloning it from github)
default => fail("Unsupported operating system: ${::operatingsystem}."),
Any idea what is wrong here?
Strange, can you tell me what following command outputs on your client machine (there where puppet agent is installed)
user@puppetclient ~ % facter --puppet | grep osfamily
osfamily => Debian
It seems like your osfamily is currently not recognized. I will going to implement it shortly
Here you go:
[root@hostname1 ~]# facter --puppet | grep osfamily
osfamily => RedHat
Just committed a fix, it seems like the regex was not working as expected. See 3c97c583fcbfe547ffc317c9a6dead777de9c003
Pull from my repo and try again
That fix worked but now it's getting stuck at another one:
Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Must pass ad_domain to Class[Pbis] on node
When looking at my ad_domain value in my class, it looks good:
class pbis_puppet {
class { 'pbis':
ad_domain => 'mydomain.com',
bind_username => 'admin',
bind_password => 'password',
user_domain_prefix => 'MYDOMAIN',
home_dir_template => '%H/%U',
login_shell_template => '/bin/bash',
service_name => 'lwsmd',
ou => 'ou=Linux',
package => 'pbis-enterprise',
package_prerequired => 'pbis-enterprise-upgrade',
}
}
I'm a bit confused by this error. it looks correctly.
just in case. can you send me your version of puppet?
localadmin@puppetmaster ~ % puppet --version
3.4.3
Sure, here you go:
[root@hostname1 ~]$ puppet --version
3.4.3 (Puppet Enterprise 3.2.3)
Hi @dionysius
This time I got a little closer but the update_dns portion is failing:
Notice: /Stage[main]/Pbis/Exec[update_DNS]/returns: Failed to update DNS. Error code [9554]
Error: update-dns returned 82 instead of one of [0,204]
Error: /Stage[main]/Pbis/Exec[update_DNS]/returns: change from notrun to 0 204 failed: update-dns returned 82 instead of one of [0,204]
So, when I run a "pbis-status" to check if it joined, it looks like it did but I get nothing back:
[root@hostname1 bin]# ./pbis-status
LSA Server Status:
Compiled daemon version: 8.0.1.2029
Packaged product version: 8.0.2031.67578
Uptime: 0 days 22 hours 43 minutes 22 seconds
[Authentication provider: lsa-activedirectory-provider]
Status: Unknown
Mode: Unknown
When I go into my AD server, I see the server added in the proper OU
So here are more errors I am seeing with the module being ran:
Jun 5 16:03:13 hostname1 lsass: [lsass] Failed to run provider specific request (request code = 12, provider = 'lsa-activedirectory-provider') -> error = 2692, symbol = NERR_SetupNotJoined, client pid = 3332
Jun 5 16:03:14 hostname1 lsass: [lsass] A cell cannot be found, and unprov mode has been disabled by configuration. If you truly wish to use unprov mode, change the cell-support setting to full.
Jun 5 16:03:14 hostname1 lsass: [lsass] Error 40044 occurred while putting an ldap connection back in the domain free list.
Jun 5 16:03:14 hostname1 lsass: [lsass] Failed to run provider specific request (request code = 8, provider = 'lsa-activedirectory-provider') -> error = 40050, symbol = LW_ERROR_NO_SUCH_CELL, client pid = 3339
Jun 5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[join_domain]/returns) Joining to AD Domain: mydomain.com
Jun 5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[join_domain]/returns) With Computer DNS Name: hostname1.mydomain.com
Jun 5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[join_domain]/returns) Error: LW_ERROR_NO_SUCH_CELL [code 0x00009c72]
Jun 5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[join_domain]/returns) Failed to find the Cell in Active Directory
Jun 5 16:03:14 hostname1 puppet-agent[2304]: domainjoin-cli join --ou Linux mydomain.com admin password returned 1 instead of one of [0]
Jun 5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[join_domain]/returns) change from notrun to 0 failed: domainjoin-cli join --ou Linux mydomain.com admin password returned 1 instead of one of [0]
Jun 5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/File[/etc/pbis/pbis.conf]) Dependency Exec[join_domain] has failures: true
Jun 5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/File[/etc/pbis/pbis.conf]) Skipping because of failed dependencies
Jun 5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[configure_pbis]) Dependency Exec[join_domain] has failures: true
Jun 5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[configure_pbis]) Skipping because of failed dependencies
Jun 5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[clear_ad_cache]) Dependency Exec[join_domain] has failures: true
Jun 5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[clear_ad_cache]) Skipping because of failed dependencies
Jun 5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[update_DNS]) Dependency Exec[join_domain] has failures: true
Jun 5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[update_DNS]) Skipping because of failed dependencies
Jun 5 16:03:34 hostname1 puppet-agent[2304]: Finished catalog run in 52.09 seconds
Ah, there are two possible reasons. I think it's something wrong with the join process, so it might be not a puppet-pbis error. Lets try to debug that. I see the error is called 'LW_ERROR_NO_SUCH_CELL', currently cannot understand what this should mean.
Or, domainjoin maybe hasn't worked because the user has not permission (or accidentally wrong credentials) to add a system (sounds strange to me, because on your AD the system is showing up - but maybe just not completely added).
Anyway what case it is, please try the domainjoin process completely by hand - for debugging purposes.
domainjoin-cli leave [username] [password]
(if it says you're not joined yet, continue with 2)domainjoin-cli join [--assumeDefaultDomain {yes|no}] [--userDomainPrefix <short domain name>] [--ou <organizationalUnit>] <domain name> <user name> [<password>]
pbis status
output or error output from commands aboveAnd just in case, are on your system the pbis binaries located in /opt/pbis/bin/ too?
Ok, so to answer your question, yep, my binaries are in that locations:
[root@hostname1 packages]# ls /opt/pbis/bin/
ad-cache del-group enum-members find-group-by-id get-dc-list gp-admin klist lsa lwsm query-member-of sqlite3
add-group del-user enum-objects find-group-by-name get-dc-name gporefresh ktutil lwautoenroll-test mod-group regshell uninstall.sh
add-user domainjoin-cli enum-users find-objects get-dc-time gprsrtmnt.sh kvno lwcertd mod-user samba-interop-install update-dns
adtool edit-reg eventlog-cli find-user-by-id get-metrics kdestroy ldapsearch lwio-copy passwd setkey-cli ypcat
config enum-groups find-by-sid find-user-by-name get-status kinit list-groups-for-user lwio-driver pbis-status snmptrap ypmatch
Here is the output when leaving the domain:
[root@hostname1 packages]# domainjoin-cli leave admin password
Leaving AD Domain: MYDOMAIN.COM
SUCCESS
However, even if it says it was a success, if I go back to AD, the system is still there and I have to delete it from AD. If not, I can't join again and get the following error if the system already exist in AD:
[root@hostname1 packages]# domainjoin-cli join --assumeDefaultDomain yes --ou Linux mydomain.com admin password
Joining to AD Domain: mydomain.com
With Computer DNS Name: hostname1.mydomain.com
Error: LW_ERROR_LDAP_INSUFFICIENT_ACCESS [code 0x00009d8b]
Once I delete the system from AD, I am able to join but this is the error I am getting:
[root@hostname1 packages]# domainjoin-cli join --assumeDefaultDomain yes --ou Linux mydomain.com admin password
Joining to AD Domain: mydomain.com
With Computer DNS Name: hostname1.mydomain.com
Error: LW_ERROR_NO_SUCH_CELL [code 0x00009c72]
Failed to find the Cell in Active Directory
However, if I go to AD and check the Linux OU, I see the system added
Ok, thats the point I've expected. The same error message appeared this way. So you need to sort out why you are getting this error, because I have no idea what this error means and a short googling didn't help. According to this Installation Guide:
Cell Manager A snap-in for the Microsoft Management Console to manage cells associated with Active Directory Organizational Units. There are many things related to 'cells' in this document. Maybe you find out what this means.
But actually I can't help you here anymore. You may now use your enterprise support and contact the vendor for help sorting this out. This issue is now not related to this module anymore.
Hello @unix4linux Any progress on your issue? Did you managed to contact their support?
Hi!! Yep, I am working out some issues with their support team. As soon as I get the issues resolved, I want to post my feedback on GitHub for those that use the enterprise version. I will let you know the outcome as soon as it gets resolved and thanks so much 😀 On Jun 13, 2014 9:15 AM, "dionysius" notifications@github.com wrote:
Hello @unix4linux https://github.com/unix4linux Any progress on your issue? Did you managed to contact their support?
— Reply to this email directly or view it on GitHub https://github.com/ctf/puppet-pbis/issues/6#issuecomment-46009287.
How would I pass options to the domainjoin-cli command? For example, what if I wanted to use two options right before the --ou option such as:
domainjoin-cli join --notimesync --disable hostname --ou ou=Linux join_user_name join_user_passwd
Hi @unix4linux
I'm having the exact same issue with PBIS Enterprise, I didnt have any problems with PBIS Open. What was your resolution?
Thanks.
Hi @Finchster
I listed several issues on this thread. Which one are you actually having issues with?
Hi
I have the exact same issue - with the server not joining AD with the same error of "Error: LW_ERROR_NO_SUCH_CELL [code 0x00009c72]" also i see the object in AD. Did you find a solution with support?
Hi jamesb78,
Can I see what line you are using to join? I don't remember what I did to get it to work but perhaps doing a little debugging with you will help me remember so that I can help you :)
Sure its:
./domainjoin-cli join --ou "AD OU" --disable hostname --assumeDefaultDomain yes
I have the same error even though we have had other systems joining the same OU (assuming that is the error) - The line above has been used numerous times previously on other servers.
https://github.com/ctf/puppet-pbis/pull/15 has some fixes for some of these issues.
The Cell error comes up because you haven't run configuration settings in Active Directory to create the cell. "/opt/pbis/bin/adtool -a new-cell" allows you to do so from Linux, but you'll need an account with appropriate rights in AD.
Hello @dionysius,
For PBIS Enterprise, the packages names are:
pbis-enterprise-8.0.1-2031.x86_64.rpm pbis-enterprise-devel-8.0.1-2031.x86_64.rpm pbis-enterprise-gui-8.0.1-2031.x86_64.rpm pbis-enterprise-legacy-8.0.1-2031.x86_64.rpm pbis-enterprise-upgrade-8.0.1-2031.x86_64.rpm
Also, when create a new class in init.pp, I have done the following:
However, puppet complains in the logs that it could not find class pbis and it gives me a 400 error. Not sure if this module needs something added to the class for it to detect it.