/usr/libexec/realm_join_with_password realm join <domainname> --unattended --user=USER-ADMIN' returned 1 instead of one of [0]

[htallur]

when I apply this modules, it run cleans on few nodes and on some nodes it throws an error even though AD users are able to login.

change from notrun to 0 failed: '/usr/libexec/realm_join_with_password realm join --unattended --user=USER-ADMIN' returned 1 instead of one of [0]Source:/Stage[main]/Realmd::Join::Password/Exec[realm_join_with_password]/returnsFile:/etc/puppetlabs/code/environments/production/modules/realmd/manifests/join/password.ppLine:29

 

even though it works, it looks bad on reporting perspective. since a failure is logged at every event run.

[acurus-puppetmaster]

Typically this is because of

Notice: /Stage[main]/Realmd::Join::Password/Exec[realm_join_with_password]/returns: realm: Already joined to this domain

The code is not idempotent.

[acurus-puppetmaster]

Seems in my case because I am specifying an exact domain controller to join the domain (we run AD sites & services) and discovery of site specific domain controllers doesn't work.

This causes the 'unless' protection on the exec for realm_join_with_password to fail as its looking for hostname@controller.domain rather than hostname@domain.

[paesano2003]

Hi, thanks for your module.

Once a server is already joined to the domain, is it possible to avoid this error thrown by Puppet on subsequent agent runs?

[alexseys]

Hi All
Same here about "Already joined to this domain" how can this be avoided or suppressed?

[walkamongus]

These issues appear to be context-sensitive to the AD infrastructure around the nodes. I will gladly accept PRs for adding handling of any new cases, but I'll be unable to reproduce AD domains that produce these cases in order to come up with fixes myself.

[alexandrud]

Seems in my case because I am specifying an exact domain controller to join the domain (we run AD sites & services) and discovery of site specific domain controllers doesn't work.

This causes the 'unless' protection on the exec for realm_join_with_password to fail as its looking for hostname@controller.domain rather than hostname@domain.

This seems to be my case as well. DNS discovery on Linux doesn't play well with Sites and Services. The firewall blocks access to other domain controllers except the ones in the site. In order for realm command to work we've set up one of the domain controllers in our site in the "domain variable".

`class { '::realmd':

       domain                  => 'dc01.example.com',

       domain_join_user        => 'join-user',

       domain_join_password    => 'somepassword',

       krb_ticket_join         => false,

       krb_keytab              => '/tmp/keytab',

       manage_sssd_config      => true,

       manage_krb_config       => true,

       ou                      => 'OU=Desktops,OU=City, OU=Global,DC=example,DC=com',`

[alexseys]

My original issue was "Already joined systems still try to join the domain"
Solution:
In join/password.pp there is a line:
unless => "klist -k /etc/krb5.keytab | grep -i '${::hostname[0,15]}@${_domain}'",

In my case removing [0,15] actually started to work as expected.
my klist does not show hosts with any numbers at the end