Enabling the Active Directory service gives an error.
Detailed step by step instructions to reproduce the problem
connection in the terminal through the realm with the same credentials goes fine
but there I indicate the domain name and not the domain controller
If I specify a domain in WEB-UI, it cannot be resolved. the terminal resolves the domain correctly
Traceback (most recent call last):
File "/opt/rockstor/src/rockstor/rest_framework_custom/generic_view.py", line 41, in _handle_exception
yield
File "/opt/rockstor/src/rockstor/smart_manager/views/active_directory.py", line 163, in post
config["workgroup"] = domain_workgroup(domain, method=method)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/rockstor/src/rockstor/system/directory_services.py", line 311, in domain_workgroup
o, e, rc = run_command(cmd, log=True)
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/rockstor/src/rockstor/system/osi.py", line 290, in run_command
raise CommandException(cmd, out, err, rc)
system.exceptions.CommandException: Error running a command. cmd = /usr/bin/net ads workgroup --realm=SRVDC0.DOM.LOCAL. rc = 255. stdout = ['']. stderr = ['ads_connect: No logon servers are currently available to service the logon request.', "Didn't find the cldap server!", '']
@grif thanks for the error report. Could you let us know which version of Rockstor you are using?
The only thing I noticed it that there seems to be an additional . at the end of the realm, but not sure whether that’s just the way the traceback reports it out:
I assume, if you try to ping the server from Rockstor’s command line that you get a response?
Have you tried to join the domain from the command line to see whether this is an issue within Rockstor or a general problem (e.g. lack of connectivity, missing packages though that should not be the root cause, etc.).
System is running Rockstor version: 5.0.12-0
Uses openSUSE Leap: 1
Linux: 6.4.0-150600.23.7-default
/usr/bin/net ads workgroup --realm=SRVDC0.DOM.LOCAL.
ads_connect: No logon servers are currently available to service the logon request.
Didn’t find the cldap server!
net ads lookup -S 10.55.2.2
Information for Domain Controller: 10.55.2.2
Response Type: LOGON_SAM_LOGON_RESPONSE_EX
GUID:
Flags:
Is a PDC: yes
Is a GC of the forest: yes
Is an LDAP server: yes
Supports DS: yes
Is running a KDC: yes
Is running time services: yes
Is the closest DC: yes
Is writable: yes
Has a hardware clock: no
Is a non-domain NC serviced by LDAP server: no
Is NT6 DC that has some secrets: no
Is NT6 DC that has all secrets: yes
Runs Active Directory Web Services: yes
Runs on Windows 2012 or later: yes
Runs on Windows 2012R2 or later: yes
Runs on Windows 2016 or later: yes
Has a DNS name: no
Is a default NC: no
Is the forest root: no
Forest: DOM.LOCAL.
Domain: DOM.LOCAL.
Domain Controller: SRVDC0.DOM.LOCAL.
Pre-Win2k Domain: DOM
Pre-Win2k Hostname: SRVDC0
Server Site Name: ЦО
Client Site Name: ЦО
NT Version: 5
LMNT Token: ffff
LM20 Token: ffff
I unfortunately do not have access to my local AD test setup to verify this myself (currently moving) so I’ll try to help as much as possible without that. Fortunately, you provided a lot of information so it gives us a good idea, I think.
I believe yourself and @Hooverdan are both correct and on the right track In particular, I’m thinking about:
… alongside
My first thought is an issue with the domain name entered in the webUI. Indeed, based on what you described (quoted above) and the realm input, it seems you may try to enter the domain name directly and not the domain controller (that’s if I understand your AD setup correctly).
The above tends to support that so I would try that first. I’m not sure where you left you system at given you have tried (and joined) using the cli so you may need to leave the AD (realm leave <domain-name>) and even clear SSSD’s cache. That’s if you want Rockstor to take care of that, of course.
As a side note, I thought I would detail a bit more the process used by Rockstor to join an AD in case it helps your troubleshooting.
First, we make sure that time synchronization is set up:
Then, we make sure the Rockstor machine can see the AD domain.
Then, we fetch the WORKGROUP currently setup on the AD server to ensure that Samba running on the Rockstor machine is set using the same (and we set it up if needed).
This is the step that is failing for you so let’s look at it: in short, we’re using net to fetch just that:
Hopefully this helps move things along at least a bit further.
The code snippets @Flox references are to help understand how Rockstor works: we rely on folks reports and feedback to help us help them get to what has gone wrong, or in this case a suspected miss-entry/miss-config during the AD setup. You can also then see the other elements that we tie together to configure AD.
I.e. as you have already now done some CLI based configuration, it may conflict with what the Web-UI entered config may try to apply, or re-apply if you reconfigur it according to @Flox & @Hooverdan suspicion after looking at your feedback. So they have suggested you do a realm leave command and clear the sssd cache (sorry I don’t know this area well) then try to re-do your Web-UI AD config according to the advice.
I made realm leave and clear sss_cache
ntp and samba services “on”
/usr/bin/net ads workgroup --realm=SRVDC0.DOM.LOCAL.
ads_connect: No logon servers are currently available to service the logon request.
Didn’t find the cldap server!
/usr/bin/net ads workgroup --realm=dom.local.
Workgroup: DOM
but I still have the same error as the first message
Thanks for checking these, @grif , it seems to confirm you need to enter the second one as the “Domain / Realm name” in the Web UI configuration. Following your example, it would be dom.local
Traceback (most recent call last):
File “/opt/rockstor/src/rockstor/smart_manager/views/active_directory.py”, line 58, in _resolve_check
socket.gethostbyname(domain)
socket.gaierror: [Errno -2] Name or service not known
This is an unrelated Web-UI bug due to some older libs we still use there. Just refresh the page using the browser, and this goes away. It has no other bearing. We are due to begin refreshing/updating our Web-UI libs/technologies in the next testing phase.
created a test pool on a flash drive. domain group rights were assigned to him without errors.
Tell me how to fix the old shares so that they can accept the rights of the new domain
