Reading man realm I see the following:
--computer-ou=OU=xxx
The distinguished name of an organizational unit to create the computer account. The exact format of the distinguished name depends on the
membership software. You can usually omit the root DSE portion of distinguished name. This is an Active Directory specific option.
I interpret that as realm beeing able to create a computer account as needed in active directory.
Putting it to the test however it fails:
[root@client ~]# realm join --user=svc-linux-join --computer-ou=OU=servers,OU=linux,DC=domain,DC=bls --os-name=CentOS --os-version=7 --automatic-id-mapping=no domain.bls < <(echo 'L3t-m3-in')
Password for svc-linux-join:
See: journalctl REALMD_OPERATION=r1695.2763
realm: Couldn't join realm: Joining the domain domain.bls failed
[root@client ~]# journalctl REALMD_OPERATION=r1695.2763
-- Logs begin at Thu 2019-09-19 22:00:08 CEST, end at Thu 2019-09-19 22:28:25 CEST. --
Sep 19 22:28:25 client realmd[2759]: * Resolving: _ldap._tcp.domain.bls
Sep 19 22:28:25 client realmd[2759]: * Performing LDAP DSE lookup on: 10.0.2.15
Sep 19 22:28:25 client realmd[2759]: * Successfully discovered: domain.bls
Sep 19 22:28:25 client realmd[2759]: * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net
Sep 19 22:28:25 client realmd[2759]: * LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.2B8L8Z -U svc-linux-join ads join domain.bls createcomputer=linux/serve
Sep 19 22:28:25 client realmd[2759]: Enter svc-linux-join's password:
Sep 19 22:28:25 client realmd[2759]: Failed to join domain: failed to precreate account in ou ou=servers,ou=linux,dc=DOMAIN,dc=BLS: No such object
Sep 19 22:28:25 client realmd[2759]: ! Joining the domain domain.bls failed
I first believed it to be a limitation of the privileges delegated to svc-linux-join so I let administrator@domain.bls have a go as well, same result:
[root@client ~]# realm join --computer-ou=OU=servers,OU=linux,DC=domain,DC=bls --os-name=CentOS --os-version=7 --automatic-id-mapping=no domain.bls
Password for Administrator:
See: journalctl REALMD_OPERATION=r1740.2772
realm: Couldn't join realm: Joining the domain domain.bls failed
[root@client ~]# journalctl REALMD_OPERATION=r1740.2772
-- Logs begin at Thu 2019-09-19 22:00:08 CEST, end at Thu 2019-09-19 22:29:14 CEST. --
Sep 19 22:29:11 client realmd[2759]: * Resolving: _ldap._tcp.domain.bls
Sep 19 22:29:11 client realmd[2759]: * Performing LDAP DSE lookup on: 10.0.2.15
Sep 19 22:29:11 client realmd[2759]: * Successfully discovered: domain.bls
Sep 19 22:29:14 client realmd[2759]: * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net
Sep 19 22:29:14 client realmd[2759]: * LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.UK8T8Z -U Administrator ads join domain.bls createcomputer=linux/server
Sep 19 22:29:14 client realmd[2759]: Enter Administrator's password:
Sep 19 22:29:14 client realmd[2759]: Failed to join domain: failed to precreate account in ou ou=servers,ou=linux,dc=DOMAIN,dc=BLS: No such object
Sep 19 22:29:14 client realmd[2759]: ! Joining the domain domain.bls failed
I then tried pre-creating the computer account:
And join again:
[root@client ~]# realm join --user=svc-linux-join --computer-ou=OU=servers,OU=linux,DC=domain,DC=bls --os-name=CentOS --os-version=7 --automatic-id-mapping=no domain.bls < <(echo 'L3t-m3-in')
Password for svc-linux-join:
See: journalctl REALMD_OPERATION=r2567.12844
realm: Couldn't join realm: Insufficient permissions to join the domain domain.bls
[root@client ~]# journalctl REALMD_OPERATION=r2567.12844
-- Logs begin at Thu 2019-09-19 22:00:08 CEST, end at Thu 2019-09-19 22:47:21 CEST. --
Sep 19 22:42:58 client realmd[12848]: * Resolving: _ldap._tcp.domain.bls
Sep 19 22:42:58 client realmd[12848]: * Performing LDAP DSE lookup on: 10.0.2.15
Sep 19 22:42:58 client realmd[12848]: * Successfully discovered: domain.bls
Sep 19 22:42:58 client realmd[12848]: * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net
Sep 19 22:42:58 client realmd[12848]: * LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.F0897Z -U svc-linux-join ads join domain.bls createcomputer=linux/serv
Sep 19 22:42:58 client realmd[12848]: Enter svc-linux-join's password:
Sep 19 22:42:58 client realmd[12848]: Failed to join domain: Failed to set password for machine account (NT_STATUS_ACCESS_DENIED)
Sep 19 22:42:58 client realmd[12848]:
Sep 19 22:42:58 client realmd[12848]: ! Insufficient permissions to join the domain domain.bls
Now that the account exists I get another error. Going back as administrator:
[root@client ~]# realm join --computer-ou=OU=servers,OU=linux,DC=domain,DC=bls --os-name=CentOS --os-version=7 --automatic-id-mapping=no domain.bls
Password for Administrator:
It just works.
If I delete the computer account and re-join the domain without specifying the desired OU for the computer account it works as well:
[root@client ~]# realm leave --remove
Password for Administrator:
[root@client ~]# realm join domain.bls
Password for Administrator:
[root@client ~]# ldapsearch -LLL -x -h server -b dc=domain,dc=bls -D svc-linux-join -w L3t-m3-in cn=client distinguishedName | grep -v -e ^# -e ^$
dn: CN=client,CN=Computers,DC=domain,DC=bls
distinguishedName: CN=client,CN=Computers,DC=domain,DC=bls
Should I not be able to let realm join create computer accounts in a specified OU using the account with delegated privileges to the OU?
