martencassel
commented
5 months ago Thanks for your issue, apprieciate it :-)
Little curios to know what version of Red Hat Satellite are you using and what distro ? :-)
Open KingDaveRa opened 5 months ago
martencassel
commented
5 months ago Thanks for your issue, apprieciate it :-)
Little curios to know what version of Red Hat Satellite are you using and what distro ? :-)
martencassel
commented
5 months ago As was previously suggested as a fix in previous issues, and in the workaround you provided we lack sane error handling code in the plugin. We just call enroll.join hoping it wont give us an exception. There are no sane error handling anywhere actually.
For example here https://github.com/theforeman/smart_proxy_realm_ad_plugin/blob/450184982d430bfc2d9051c5e68da885d7e871b7/lib/smart_proxy_realm_ad/provider.rb#L104.
In the initial work for this project, i had one DC in my dev environment, but every organization run multiple DCs.
KingDaveRa
commented
5 months ago Thanks for your issue, apprieciate it :-)
Little curios to know what version of Red Hat Satellite are you using and what distro ? :-)
The Satellite server is on Satellite 6.14.2 (latest I think?) and RHEL 8.9.
I do have multiple DCs in the domain, (six actually), but the config is nailed to the PDC. I suppose it's possible it's wandering to others? AD does like going everywhere but where you ask!
So I suppose a good starting point for me might be to try and catch the errors (if at all) coming back from radcli. It's odd, because it does create the object, but maybe it's failing at the next step. I'm wondering if the password generated is complex enough perhaps, or even the right length? I suppose just because the object exists doesn't mean it was 100% successful.
martencassel
commented
3 weeks ago Thanks again for your issue, im waiting to get my test environment setup before i can test this fix. See the current PR.
Hello
I'm very keen to use this module with Satellite as I simply need to bind my servers to AD wth SSSD, so it's just what I need. However, it doesn't work!
Our domain is now on 2022 DCs, and 2012 R2 functional level.
I've got latest Satellite and the radcli, and this plugin installed. It runs, and it did once work (with previous 2012 DCs), but I had an issue whereby the kerberos ticket would age out and not refresh, so it would stop working. I'd usually find renewing the ticket got it going again. I want to get it working properly again, so I'm revisiting, but I'm hitting a total stop now.
When I create a new machine through Satellite, it fails:
From the debug logs:
HOWEVER - the computer object exists in AD, as it got created.
So my next step was to cobble together a basic script using adcli to try and bind and do a join (I forget where I borrowed most of this from).
As far as I can see, this works. No errors, and a seemingly complete AD computer object.
So my theory is that radcli is totally fine and working, but this plugin is failing to understand what it's returning, and falls on its face.
I've done a little bit of Ruby in the past so I'm happy to prod this about and try and make it work, just not 100% sure where in the code to look, or if this is even fixable. Looking for a steer as much as anything. I also notice this code is very old, so is it potentially a dead-end to try and fix? OR, is there a better way I don't know about? Plan b is I just script this all directly in Satellite... but then the fun of stored passwords comes back again.
All help most gratefully received.