search

plus3it / join-domain-formula

Salt formula to join systems to an Active Directory domain
Apache License 2.0
13 stars 19 forks source link

Allows the setting of OS Name and Version AD-Attributes to be optional #173

Closed ferricoxide closed 1 year ago

ferricoxide commented 1 year ago

Closes #172

New behavior defaults to not attempting to set either the OS Name or OS Version AD-attributes. It's now explicitly required that environment-variables:

Be set to True in order for either/both variables to cause the sssd module's join.sh script to attempt to set the AD-attributes

ferricoxide commented 1 year ago

Note: Have currently only tested against Simple AD. Will test against "proper" AD, shortly.

ferricoxide commented 1 year ago

Validated against "proper" AD. Worth noting:

  1. If the join-user account has fine-grained restrictions applied and that user hasn't been delegated the ability to set AD object-attributes, if the launch-set hostname is not in the same domain as the AD server, the join operation will fail like: 
    Feb 24 11:46:47 jd-issue172.dev.lab realmd[11068]:         0: 0000200B: DSID-033E101D, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 906b5 (msDS-AdditionalDnsHostName)

    Discovered this because I carried my userData payload from our Simple AD-enabled test-environment to our "proper" AD-enabled environment without changing the cloud-config:fqdn value to match the new environment. When executed under a full watchmaker run – with its preceding use of the name-computer-formula – this should not be an issue that anyone ever sees.

  2. With current logic, if the test environment isn't using AD-Integrated DNS, this formula doesn't create a DNS entry (like it does in AD-integrated DNS environments). Likely need to address this gap by other means.