All,
We have a certain end condition that's troubling. I'm guessing we can just throw a flag to realm join, or put a setting in /etc/realmd.conf to fix. Let me explain.
Here's the usual situation. New fresh build. We join the AD domain as so:
realm join -v --automatic-id-mapping=no --computer-ou="OU=Servers,OU=UNIX,DC=$SUPPORTREGION,DC=COMPANY,DC=COM" --user-principal="host/`hostname --fqdn`@$JOINDOMAIN" $JOINDOMAIN
Fresh build -- this works fine. This creates the machine object in AD, in our specific OU. Sets the hosts credentials in that machine object, saves these host credentials in /etc/krb5.keytab file.
Life is good.
When we re-image a server, hopefully we remember to do a 'realm leave <DOMAIN>' prior to re-imaging. That goes out, destroys the AD machine object in our OU, possibly other cleanups.
Then we re-image. realm join (as above) finds no AD object, it does the usual. Life is good.
Here's the end condition that isn't good. If we re-image and we've forgotten to 'realm leave <DOMAIN>', then a pre-existing AD object exists already in our OU. By the desired name.
In that case, when we re-image the above 'realm join' invocation does not overwrite the host creds in this pre-existing machine object. And does not create an /etc/krb5.keytab file.
Because it does not create an /etc/krb5.keytab file the 'realm join' does not fully successfully complete.
We have experience with a previous (3rd party) AD integration product. In that product, if you have a pre-existing AD object, it informs you an AD object has been found, existing configuration will be overwritten. Then it updates the host creds in that pre-existing machine object and it lays down a keytab file with the host creds.
That is, if it finds a pre-existing AD machine object it soldiers on anyway.
We'd like to tweak our realm join to do that behavior. If pre-existing AD machine object detects, overwrite the host creds in that machine object and create /etc/krb5.keytab file with those same host creds. I.e., soldier on.
What flag do we throw to realm join to do that? Or what setting in /etc/realmd.conf do we set?
This is on RHEL7 (sssd version 1.16.2-13) and RHEL8 (sssd version 2.0.0-23).
Spike