-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Today I spent some time playing around with the realmd provider in OpenLMI. My specific intent was to see what it might take to be able to configure the FreeIPA Domain Controller to be able to enroll clients into the domain from the central server (assuming that they know an appropriate Pegasus username).
I put together a RHEL 7 kickstart (attached[1]) containing the minimum set of software necessary to use OpenLMI.
- From there, I proceeded to try to use the realmd provider to join a domain of a FreeIPA server I had previously set up.
The following steps proved necessary:
1) Use the OpenLMI Software Provider to install the 'openlmi-realmd' package, since it's not included as a dependency of the 'openlmi' meta-package
2) Use the OpenLMI Networking provider to change the DNS server to be the one provided by FreeIPA. (Unless already handled by DHCP, which it was not in my case).
3) Use the OpenLMI Software Provider to install the 'ipa-client' package and its dependencies, because the realmd JoinDomain() method reports "CIM_ERR_FAILED: LMI: dbus_join_call() failed: (RDCP_ERROR_DBUS(4)) dbus error (org.freedesktop.realmd.Error.Failed): Necessary packages are not installed: ipa-client, oddjob, oddjob-mkhomedir, sssd: 'JoinDomain'"
4) Call the realmd JoinDomain() command with the appropriate privileges.
After this, the client was correctly registered as a member of the FreeIPA domain.
I think there are several things that we can improve in this flow.
First of all, I think that if JoinDomain() reports that packages need to be installed, it should implicitly invoke the Software provider and install them; thus only returning a failure to the caller if the packages are unavailable for installation.
Secondly, I think we should consider including 'openlmi-realmd' as one of the packages pulled in by the 'openlmi' meta-package.
It would also be useful for the JoinDomain() method to accept an optional argument to provide the DNS server address, so a client could indicate that the standard DHCP-assigned DNS addresses are not correct for this domain.
Additionally, I think we should explore the possibility of enhancing our OpenSLP attributes such that it would be possible to query SLP for "all machines on the network that have the openlmi-realmd provider installed and are not currently on a domain (or are currently joined to domain X, etc.). This would make it possible for FreeIPA's GUI or CLI to present the domain administrator with a list of machines that could be joined to the domain.
[1] This kickstart is likely incomplete, as it will need to be tailored for your environment to be able to access the appropriate RPM installation channels. I omitted those from the included kickstart because I was using a local mirror.