1:34 a.m.
On ti, 04 joulu 2018, d.iskandarov--- via FreeIPA-users wrote:
Hello,
I'm interested if there is good way to check that host has joined IPA domain and is in
good state, i.e. at least users are fetched from DC.
Real story: I'm registering my nodes with configuration management
system (puppet). Host is auto-registering with IPA domain. But also
before node is registered with domain I'm creating localhost users.
When I change anything in "users declaration manifest" which triggers
host update and calling usermod, deploy is failing with such error:
> Execution of '/usr/sbin/usermod -p !! john' returned 6: usermod: user
> 'john' does not exist in /etc/passwd
Because obviously during that second run host has already joined domain
and system gets user info from LDAP and not /etc/passwd.
In a typical deployment
both local and remote users are resolvable, so
if john exists in /etc/passwd but doesn't exist in FreeIPA, it would
still be accessible for modifications.
I'm creating "flag" file /root/.ipa-registered which prevents further
ipa-client installation and registration steps. Obviously ipa-client
install quite a few packages on the OS which I can check for existence
and skip run as well.
I'm interested if there is more programmatic way to test that node is
functional in domain, maybe some ipa related tool exists on host which
i can execute and get status. Which will allow me to judge if I should
touch users on localhost.
You have:
- /etc/ipa/default.conf, which points with xmlrpc_uri to IPA master
this host is enrolled into. The config is created during
ipa-client-install
- /etc/krb5.keytab should contain a host/.. key issued in the name of
this host (klist -k)
- at least one of IPA users should be resolvable, like 'admin' (getent
passwd admin)
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland