What is the best way to check that host has joined domain from host itself?

Hello,

I'm interested if there is good way to check that host has joined IPA domain and is in
good state, i.e. at least users are fetched from DC.

Real story:
I'm registering my nodes with configuration management system (puppet). Host is
auto-registering with IPA domain.
But also before node is registered with domain I'm creating localhost users.
When I change anything in "users declaration manifest" which triggers host
update and calling usermod, deploy is failing with such error:
>  Execution of '/usr/sbin/usermod -p !! john' returned 6:
> usermod: user 'john' does not exist in /etc/passwd 
Because obviously during that second run host has already joined domain and system gets
user info from LDAP and not /etc/passwd.

I'm creating "flag" file /root/.ipa-registered which prevents further
ipa-client installation and registration steps.
Obviously ipa-client install quite a few packages on the OS which I can check for
existence and skip run as well.

I'm interested if there is more programmatic way to test that node is functional in
domain, maybe some ipa related tool exists on host which i can execute and get status.
Which will allow me  to judge if I should touch users on localhost.

Thanks in advance

Denis

[Alexander Bokovoy]

On ti, 04 joulu 2018, d.iskandarov--- via FreeIPA-users wrote:
> Hello,
>
> I'm interested if there is good way to check that host has joined IPA domain and is in
> good state, i.e. at least users are fetched from DC.
>
> Real story: I'm registering my nodes with configuration management
> system (puppet). Host is auto-registering with IPA domain.  But also
> before node is registered with domain I'm creating localhost users.
> When I change anything in "users declaration manifest" which triggers
> host update and calling usermod, deploy is failing with such error:
> > Execution of '/usr/sbin/usermod -p !! john' returned 6: usermod: user
> > 'john' does not exist in /etc/passwd
>
> Because obviously during that second run host has already joined domain
> and system gets user info from LDAP and not /etc/passwd. 
In a typical deployment
both local and remote users are resolvable, so
if john exists in /etc/passwd but doesn't exist in FreeIPA, it would
still be accessible for modifications.

> I'm creating "flag" file /root/.ipa-registered which prevents further
> ipa-client installation and registration steps.  Obviously ipa-client
> install quite a few packages on the OS which I can check for existence
> and skip run as well.
>
> I'm interested if there is more programmatic way to test that node is
> functional in domain, maybe some ipa related tool exists on host which
> i can execute and get status. Which will allow me  to judge if I should
> touch users on localhost. 
You have:
 - /etc/ipa/default.conf, which points with xmlrpc_uri to IPA master
   this host is enrolled into. The config is created during
   ipa-client-install
 - /etc/krb5.keytab should contain a host/.. key issued in the name of
   this host (klist -k)
 - at least one of IPA users should be resolvable, like 'admin' (getent
   passwd admin)

-- 
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland