PBIS Enterprise #6

iamteedoh · 2014-06-04T01:08:44Z

For PBIS Enterprise, the packages names are:

pbis-enterprise-8.0.1-2031.x86_64.rpm
pbis-enterprise-devel-8.0.1-2031.x86_64.rpm
pbis-enterprise-gui-8.0.1-2031.x86_64.rpm
pbis-enterprise-legacy-8.0.1-2031.x86_64.rpm
pbis-enterprise-upgrade-8.0.1-2031.x86_64.rpm

Also, when create a new class in init.pp, I have done the following:

class 'pbis_puppet' {
  class { 'pbis':
    ad_domain             => 'mydomain.com',
    bind_username         => 'admin',
    bind_password         => 'password',
    user_domain_prefix    => 'MYDOMAIN',
    ou                    => 'ou=Linux',
    package               => 'pbis-enterprise',
    package_prerequired   => 'pbis-enterprise-upgrade',
  }
}

However, puppet complains in the logs that it could not find class pbis and it gives me a 400 error. Not sure if this module needs something added to the class for it to detect it.

The text was updated successfully, but these errors were encountered:

dionysius · 2014-06-04T13:00:34Z

Hey @unix4linux
the class pbis should be automatically detected. Requirement for that is that the class folder is exactly called pbis.

This is an extract of my puppetmaster but updaded/changed/included things you need to insert (see comments) for your enterprise setup.

root@puppetmaster /etc/puppet # tree
.
[...]
├── manifests
│   ├── site.pp
├── modules
[...]
│   ├── pbis
│   │   ├── AUTHORS
│   │   ├── files
│   │   │   ├── pbis-enterprise.amd64.rpm
│   │   │   └── pbis-enterprise-upgrade.amd64.rpm
│   │   ├── lib
│   │   │   └── puppet
│   │   │       └── parser
│   │   │           └── functions
│   │   │               └── transform_ou.rb
│   │   ├── LICENSE
│   │   ├── manifests
│   │   │   ├── init.pp
│   │   │   └── params.pp
│   │   ├── Modulefile
│   │   ├── README.md
│   │   ├── templates
│   │   │   └── pbis.conf.erb
│   │   └── tests
│   │       └── init.pp
│   ├── my-implementation
│       └── manifests
│           └── init.pp
[...]

root@puppetmaster /etc/puppet # cat modules/my-implementation/manifests/init.pp 
class my-implementation {
[...]
    class { 'pbis':
        ad_domain => 'DIRECTORY.XXXXXXXXXX.XX',
        bind_username => 'domainjoin',
        bind_password => 'XXXXXXX',
        user_domain_prefix => 'DIRECTORY',    # you may not need that
        home_dir_template => '%H/%U',             # you may not need that
        login_shell_template => '/bin/zsh',           # you may not need that
        service_name => 'lwsmd',
                package => 'pbis-enterprise',                                        # your enterprise core package name
                package_prerequired => 'pbis-enterprise-upgrade'      # your enterprise upgrade package name
    }
[...]
}

root@puppetmaster /etc/puppet # cat manifests/site.pp
[...]
node 'host.directory.XXXXXXX.XX' {
[...]
    include my-implementation
}
[...]

While [...] is always a placeholder for other stuff you might have but it's not related to this issue.

But this should work seamlessly now if you adapt this correctly.

iamteedoh · 2014-06-04T16:49:45Z

Hello @dionysius

Everything looks good but I am getting an error for the params.pp on line 41 as follows:

Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Function 'fail' does not return a value at /etc/puppetlabs/env/development/modules/pbis/manifests/params.pp:41

When I look at the params.pp file for that line, here is the output (as expected from cloning it from github)

default           => fail("Unsupported operating system: ${::operatingsystem}."),

Any idea what is wrong here?

dionysius · 2014-06-04T18:46:45Z

Strange, can you tell me what following command outputs on your client machine (there where puppet agent is installed)

user@puppetclient ~ % facter --puppet | grep osfamily    
osfamily => Debian

It seems like your osfamily is currently not recognized. I will going to implement it shortly

iamteedoh · 2014-06-04T18:54:58Z

Here you go:

[root@hostname1 ~]# facter --puppet | grep osfamily
osfamily => RedHat

According to http://docs.puppetlabs.com/puppet/latest/reference/lang_conditional.html regex are not strings.

dionysius · 2014-06-04T19:11:19Z

Just committed a fix, it seems like the regex was not working as expected. See 3c97c58

Pull from my repo and try again

iamteedoh · 2014-06-04T19:28:54Z

That fix worked but now it's getting stuck at another one:

Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Must pass ad_domain to Class[Pbis] on node

When looking at my ad_domain value in my class, it looks good:

class pbis_puppet {
  class { 'pbis':
    ad_domain             => 'mydomain.com',
    bind_username         => 'admin',
    bind_password         => 'password',
    user_domain_prefix    => 'MYDOMAIN',
    home_dir_template     => '%H/%U',
    login_shell_template  => '/bin/bash',
    service_name          => 'lwsmd',
    ou                    => 'ou=Linux',
            package               => 'pbis-enterprise',
            package_prerequired   => 'pbis-enterprise-upgrade',
  }
}

dionysius · 2014-06-04T20:21:55Z

I'm a bit confused by this error. it looks correctly.

just in case. can you send me your version of puppet?

localadmin@puppetmaster ~ % puppet --version
3.4.3

iamteedoh · 2014-06-04T20:42:54Z

Sure, here you go:

[root@hostname1 ~]$ puppet --version
3.4.3 (Puppet Enterprise 3.2.3)

iamteedoh · 2014-06-05T18:46:04Z

Hi @dionysius

This time I got a little closer but the update_dns portion is failing:

Notice: /Stage[main]/Pbis/Exec[update_DNS]/returns: Failed to update DNS. Error code [9554]
Error: update-dns returned 82 instead of one of [0,204]
Error: /Stage[main]/Pbis/Exec[update_DNS]/returns: change from notrun to 0 204 failed: update-dns returned 82 instead of one of [0,204]

So, when I run a "pbis-status" to check if it joined, it looks like it did but I get nothing back:

[root@hostname1 bin]# ./pbis-status
LSA Server Status:

Compiled daemon version: 8.0.1.2029
Packaged product version: 8.0.2031.67578
Uptime:        0 days 22 hours 43 minutes 22 seconds

[Authentication provider: lsa-activedirectory-provider]

        Status:        Unknown
        Mode:          Unknown

When I go into my AD server, I see the server added in the proper OU

iamteedoh · 2014-06-05T20:33:51Z

So here are more errors I am seeing with the module being ran:

Jun  5 16:03:13 hostname1 lsass: [lsass] Failed to run provider specific request (request code = 12, provider = 'lsa-activedirectory-provider') -> error = 2692, symbol = NERR_SetupNotJoined, client pid = 3332
Jun  5 16:03:14 hostname1 lsass: [lsass] A cell cannot be found, and unprov mode has been disabled by configuration. If you truly wish to use unprov mode, change the cell-support setting to full.
Jun  5 16:03:14 hostname1 lsass: [lsass] Error 40044 occurred while putting an ldap connection back in the domain free list.
Jun  5 16:03:14 hostname1 lsass: [lsass] Failed to run provider specific request (request code = 8, provider = 'lsa-activedirectory-provider') -> error = 40050, symbol = LW_ERROR_NO_SUCH_CELL, client pid = 3339
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[join_domain]/returns) Joining to AD Domain:   mydomain.com
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[join_domain]/returns) With Computer DNS Name: hostname1.mydomain.com
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[join_domain]/returns) Error: LW_ERROR_NO_SUCH_CELL [code 0x00009c72]
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[join_domain]/returns) Failed to find the Cell in Active Directory
Jun  5 16:03:14 hostname1 puppet-agent[2304]: domainjoin-cli join --ou Linux   mydomain.com admin password returned 1 instead of one of [0]
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[join_domain]/returns) change from notrun to 0 failed: domainjoin-cli join --ou Linux   mydomain.com admin password returned 1 instead of one of [0]
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/File[/etc/pbis/pbis.conf]) Dependency Exec[join_domain] has failures: true
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/File[/etc/pbis/pbis.conf]) Skipping because of failed dependencies
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[configure_pbis]) Dependency Exec[join_domain] has failures: true
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[configure_pbis]) Skipping because of failed dependencies
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[clear_ad_cache]) Dependency Exec[join_domain] has failures: true
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[clear_ad_cache]) Skipping because of failed dependencies
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[update_DNS]) Dependency Exec[join_domain] has failures: true
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[update_DNS]) Skipping because of failed dependencies
Jun  5 16:03:34 hostname1 puppet-agent[2304]: Finished catalog run in 52.09 seconds

dionysius · 2014-06-06T11:45:42Z

Ah, there are two possible reasons. I think it's something wrong with the join process, so it might be not a puppet-pbis error. Lets try to debug that. I see the error is called 'LW_ERROR_NO_SUCH_CELL', currently cannot understand what this should mean.

Or, domainjoin maybe hasn't worked because the user has not permission (or accidentally wrong credentials) to add a system (sounds strange to me, because on your AD the system is showing up - but maybe just not completely added).

Anyway what case it is, please try the domainjoin process completely by hand - for debugging purposes.

Ensure you've left the AD: domainjoin-cli leave [username] [password] (if it says you're not joined yet, continue with 2)
Join AD: domainjoin-cli join [--assumeDefaultDomain {yes|no}] [--userDomainPrefix <short domain name>] [--ou <organizationalUnit>] <domain name> <user name> [<password>]
Show me your pbis status output or error output from commands above

And just in case, are on your system the pbis binaries located in /opt/pbis/bin/ too?

iamteedoh · 2014-06-06T15:27:36Z

Ok, so to answer your question, yep, my binaries are in that locations:

[root@hostname1 packages]# ls /opt/pbis/bin/
ad-cache   del-group       enum-members  find-group-by-id    get-dc-list  gp-admin      klist                 lsa                lwsm         query-member-of        sqlite3
add-group  del-user        enum-objects  find-group-by-name  get-dc-name  gporefresh    ktutil                lwautoenroll-test  mod-group    regshell               uninstall.sh
add-user   domainjoin-cli  enum-users    find-objects        get-dc-time  gprsrtmnt.sh  kvno                  lwcertd            mod-user     samba-interop-install  update-dns
adtool     edit-reg        eventlog-cli  find-user-by-id     get-metrics  kdestroy      ldapsearch            lwio-copy          passwd       setkey-cli             ypcat
config     enum-groups     find-by-sid   find-user-by-name   get-status   kinit         list-groups-for-user  lwio-driver        pbis-status  snmptrap               ypmatch

Here is the output when leaving the domain:

[root@hostname1 packages]# domainjoin-cli leave admin password
Leaving AD Domain:   MYDOMAIN.COM
SUCCESS

However, even if it says it was a success, if I go back to AD, the system is still there and I have to delete it from AD. If not, I can't join again and get the following error if the system already exist in AD:

[root@hostname1 packages]# domainjoin-cli join --assumeDefaultDomain yes --ou Linux mydomain.com admin password
Joining to AD Domain:   mydomain.com
With Computer DNS Name: hostname1.mydomain.com


Error: LW_ERROR_LDAP_INSUFFICIENT_ACCESS [code 0x00009d8b]

Once I delete the system from AD, I am able to join but this is the error I am getting:

[root@hostname1 packages]# domainjoin-cli join --assumeDefaultDomain yes --ou Linux mydomain.com admin password
Joining to AD Domain:   mydomain.com
With Computer DNS Name: hostname1.mydomain.com


Error: LW_ERROR_NO_SUCH_CELL [code 0x00009c72]

Failed to find the Cell in Active Directory

However, if I go to AD and check the Linux OU, I see the system added

dionysius · 2014-06-07T01:32:43Z

Ok, thats the point I've expected. The same error message appeared this way. So you need to sort out why you are getting this error, because I have no idea what this error means and a short googling didn't help. According to this Installation Guide:

Cell Manager
A snap-in for the Microsoft Management Console to manage cells associated with Active Directory Organizational Units.
There are many things related to 'cells' in this document. Maybe you find out what this means.

But actually I can't help you here anymore. You may now use your enterprise support and contact the vendor for help sorting this out. This issue is now not related to this module anymore.

dionysius · 2014-06-13T13:14:59Z

Hello @unix4linux
Any progress on your issue? Did you managed to contact their support?

iamteedoh · 2014-06-13T13:25:05Z

Hi!! Yep, I am working out some issues with their support team. As soon as
I get the issues resolved, I want to post my feedback on GitHub for those
that use the enterprise version. I will let you know the outcome as soon as
it gets resolved and thanks so much 😀
On Jun 13, 2014 9:15 AM, "dionysius" [email protected] wrote:

Hello @unix4linux https://github.com/unix4linux
Any progress on your issue? Did you managed to contact their support?

—
Reply to this email directly or view it on GitHub
#6 (comment).

iamteedoh · 2014-07-16T14:54:09Z

How would I pass options to the domainjoin-cli command? For example, what if I wanted to use two options right before the --ou option such as:

domainjoin-cli join --notimesync --disable hostname --ou ou=Linux join_user_name join_user_passwd

Finchster · 2014-07-28T06:56:47Z

Hi @unix4linux

I'm having the exact same issue with PBIS Enterprise, I didnt have any problems with PBIS Open. What was your resolution?

Thanks.

iamteedoh · 2014-07-28T14:06:19Z

Hi @Finchster

I listed several issues on this thread. Which one are you actually having issues with?

jamesb78 · 2014-08-28T11:36:37Z

Hi

I have the exact same issue - with the server not joining AD with the same error of "Error: LW_ERROR_NO_SUCH_CELL [code 0x00009c72]" also i see the object in AD. Did you find a solution with support?

iamteedoh · 2014-08-28T11:43:42Z

Hi jamesb78,

Can I see what line you are using to join? I don't remember what I did to get it to work but perhaps doing a little debugging with you will help me remember so that I can help you :)

jamesb78 · 2014-08-29T07:26:30Z

Sure its:

./domainjoin-cli join --ou "AD OU" --disable hostname --assumeDefaultDomain yes

I have the same error even though we have had other systems joining the same OU (assuming that is the error) - The line above has been used numerous times previously on other servers.

docsmooth · 2017-04-03T20:15:20Z

#15 has some fixes for some of these issues.

The Cell error comes up because you haven't run configuration settings in Active Directory to create the cell. "/opt/pbis/bin/adtool -a new-cell" allows you to do so from Linux, but you'll need an account with appropriate rights in AD.

dionysius added a commit to dionysius/puppet-pbis that referenced this issue Jun 4, 2014

fix ctf#6: RedHat based systems are not recognized

3c97c58

According to http://docs.puppetlabs.com/puppet/latest/reference/lang_conditional.html regex are not strings.

dionysius mentioned this issue Jun 4, 2014

Unrecognized OSfamily will throw an error #7

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

PBIS Enterprise #6

PBIS Enterprise #6

iamteedoh commented Jun 4, 2014

dionysius commented Jun 4, 2014

iamteedoh commented Jun 4, 2014

dionysius commented Jun 4, 2014

iamteedoh commented Jun 4, 2014

dionysius commented Jun 4, 2014

iamteedoh commented Jun 4, 2014

dionysius commented Jun 4, 2014

iamteedoh commented Jun 4, 2014

iamteedoh commented Jun 5, 2014

iamteedoh commented Jun 5, 2014

dionysius commented Jun 6, 2014

iamteedoh commented Jun 6, 2014

dionysius commented Jun 7, 2014

dionysius commented Jun 13, 2014

iamteedoh commented Jun 13, 2014

iamteedoh commented Jul 16, 2014

Finchster commented Jul 28, 2014

iamteedoh commented Jul 28, 2014

jamesb78 commented Aug 28, 2014

iamteedoh commented Aug 28, 2014

jamesb78 commented Aug 29, 2014

docsmooth commented Apr 3, 2017

PBIS Enterprise #6

PBIS Enterprise #6

Comments

iamteedoh commented Jun 4, 2014

dionysius commented Jun 4, 2014

iamteedoh commented Jun 4, 2014

dionysius commented Jun 4, 2014

iamteedoh commented Jun 4, 2014

dionysius commented Jun 4, 2014

iamteedoh commented Jun 4, 2014

dionysius commented Jun 4, 2014

iamteedoh commented Jun 4, 2014

iamteedoh commented Jun 5, 2014

iamteedoh commented Jun 5, 2014

dionysius commented Jun 6, 2014

iamteedoh commented Jun 6, 2014

dionysius commented Jun 7, 2014

dionysius commented Jun 13, 2014

iamteedoh commented Jun 13, 2014

iamteedoh commented Jul 16, 2014

Finchster commented Jul 28, 2014

iamteedoh commented Jul 28, 2014

jamesb78 commented Aug 28, 2014

iamteedoh commented Aug 28, 2014

jamesb78 commented Aug 29, 2014

docsmooth commented Apr 3, 2017