Hello,
How do we get the updated package available for rubygem-radcli available on the ‘foreman-plugins’ repo?
Theres a really old version (1.0.0) there that have outstanding bugs that cause realm join problems for Active Directory. Version 1.1.0 solves these issues:
opened 10:32AM - 05 Oct 18 UTC
We've started running into issues with domains where we have multiple main DCs a… t all times, where joins tend to fail with a nonsensical authentication error - the object is created fine but the password fails to be set.
From the debugging I've done it seems to occur when the ticket for the password change is provided by a different DC than the one the actual request ends up going to.
The bug at https://bugs.freedesktop.org/show_bug.cgi?id=55487 sounds like it's exactly what we're running into.
My workaround as of so far has been to retry the password setting until successful, which works but is not at all a nice workaround - and not something I particularly want to encourage with a PR;
```patch
diff --git a/lib/smart_proxy_realm_ad/provider.rb b/lib/smart_proxy_realm_ad/provider.rb
index 640fadc..d26f424 100644
--- a/lib/smart_proxy_realm_ad/provider.rb
+++ b/lib/smart_proxy_realm_ad/provider.rb
@@ -101,7 +101,24 @@ module Proxy::AdRealm
enroll.set_host_fqdn(hostfqdn)
enroll.set_domain_ou(@ou) if @ou
enroll.set_computer_password(password)
- enroll.join
+ begin
+ enroll.join
+ return true
+ rescue RuntimeError => ex
+ raise ex unless ex.message =~ /Authentication error/
+ loop do
+ begin
+ if enroll.respond_to? :update
+ enroll.update
+ else
+ enroll.password
+ end
+ return true
+ rescue RuntimeError => ex
+ raise ex unless ex.message =~ /Authentication error/
+ end
+ end
+ end
end
def generate_password
```
The question is then; is there a better workaround for such an issue that could be done? Perhaps by finding all available DCs using a DNS lookup, and then grabbing tickets for all of them?
I’ve created the RPM for v1.1.0 but I’m not sure it distribution quality. But I can make it available if it can be useful to someone else.
Best regards, Luc.
evgeni
July 24, 2024, 6:28am
2
Woa! That was fast… Thank You!
1 Like
