PBIS Enterprise

[iamteedoh]

Hello @dionysius,

For PBIS Enterprise, the packages names are:

pbis-enterprise-8.0.1-2031.x86_64.rpm
pbis-enterprise-devel-8.0.1-2031.x86_64.rpm
pbis-enterprise-gui-8.0.1-2031.x86_64.rpm
pbis-enterprise-legacy-8.0.1-2031.x86_64.rpm
pbis-enterprise-upgrade-8.0.1-2031.x86_64.rpm

Also, when create a new class in init.pp, I have done the following:

class 'pbis_puppet' {
  class { 'pbis':
    ad_domain             => 'mydomain.com',
    bind_username         => 'admin',
    bind_password         => 'password',
    user_domain_prefix    => 'MYDOMAIN',
    ou                    => 'ou=Linux',
    package               => 'pbis-enterprise',
    package_prerequired   => 'pbis-enterprise-upgrade',
  }
}

However, puppet complains in the logs that it could not find class pbis and it gives me a 400 error. Not sure if this module needs something added to the class for it to detect it.

[dionysius]

Hey @unix4linux
the class pbis should be automatically detected. Requirement for that is that the class folder is exactly called pbis.

This is an extract of my puppetmaster but updaded/changed/included things you need to insert (see comments) for your enterprise setup.

root@puppetmaster /etc/puppet # tree
.
[...]
├── manifests
│   ├── site.pp
├── modules
[...]
│   ├── pbis
│   │   ├── AUTHORS
│   │   ├── files
│   │   │   ├── pbis-enterprise.amd64.rpm
│   │   │   └── pbis-enterprise-upgrade.amd64.rpm
│   │   ├── lib
│   │   │   └── puppet
│   │   │       └── parser
│   │   │           └── functions
│   │   │               └── transform_ou.rb
│   │   ├── LICENSE
│   │   ├── manifests
│   │   │   ├── init.pp
│   │   │   └── params.pp
│   │   ├── Modulefile
│   │   ├── README.md
│   │   ├── templates
│   │   │   └── pbis.conf.erb
│   │   └── tests
│   │       └── init.pp
│   ├── my-implementation
│       └── manifests
│           └── init.pp
[...]

root@puppetmaster /etc/puppet # cat modules/my-implementation/manifests/init.pp 
class my-implementation {
[...]
    class { 'pbis':
        ad_domain => 'DIRECTORY.XXXXXXXXXX.XX',
        bind_username => 'domainjoin',
        bind_password => 'XXXXXXX',
        user_domain_prefix => 'DIRECTORY',    # you may not need that
        home_dir_template => '%H/%U',             # you may not need that
        login_shell_template => '/bin/zsh',           # you may not need that
        service_name => 'lwsmd',
                package => 'pbis-enterprise',                                        # your enterprise core package name
                package_prerequired => 'pbis-enterprise-upgrade'      # your enterprise upgrade package name
    }
[...]
}

root@puppetmaster /etc/puppet # cat manifests/site.pp
[...]
node 'host.directory.XXXXXXX.XX' {
[...]
    include my-implementation
}
[...]

While [...] is always a placeholder for other stuff you might have but it's not related to this issue.

But this should work seamlessly now if you adapt this correctly.

[iamteedoh]

Hello @dionysius

Everything looks good but I am getting an error for the params.pp on line 41 as follows:

Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Function 'fail' does not return a value at /etc/puppetlabs/env/development/modules/pbis/manifests/params.pp:41

When I look at the params.pp file for that line, here is the output (as expected from cloning it from github)

default           => fail("Unsupported operating system: ${::operatingsystem}."),

Any idea what is wrong here?

[dionysius]

Strange, can you tell me what following command outputs on your client machine (there where puppet agent is installed)

user@puppetclient ~ % facter --puppet | grep osfamily    
osfamily => Debian

It seems like your osfamily is currently not recognized. I will going to implement it shortly

[iamteedoh]

Here you go:

[root@hostname1 ~]# facter --puppet | grep osfamily
osfamily => RedHat

[dionysius]

Just committed a fix, it seems like the regex was not working as expected. See 3c97c58

Pull from my repo and try again

[iamteedoh]

That fix worked but now it's getting stuck at another one:

Error: Could not retrieve catalog from remote server: Error 400 on SERVER: Must pass ad_domain to Class[Pbis] on node

When looking at my ad_domain value in my class, it looks good:

class pbis_puppet {
  class { 'pbis':
    ad_domain             => 'mydomain.com',
    bind_username         => 'admin',
    bind_password         => 'password',
    user_domain_prefix    => 'MYDOMAIN',
    home_dir_template     => '%H/%U',
    login_shell_template  => '/bin/bash',
    service_name          => 'lwsmd',
    ou                    => 'ou=Linux',
            package               => 'pbis-enterprise',
            package_prerequired   => 'pbis-enterprise-upgrade',
  }
}

[dionysius]

I'm a bit confused by this error. it looks correctly.

just in case. can you send me your version of puppet?

localadmin@puppetmaster ~ % puppet --version
3.4.3

[iamteedoh]

Sure, here you go:

[root@hostname1 ~]$ puppet --version
3.4.3 (Puppet Enterprise 3.2.3)

[iamteedoh]

Hi @dionysius

This time I got a little closer but the update_dns portion is failing:

Notice: /Stage[main]/Pbis/Exec[update_DNS]/returns: Failed to update DNS. Error code [9554]
Error: update-dns returned 82 instead of one of [0,204]
Error: /Stage[main]/Pbis/Exec[update_DNS]/returns: change from notrun to 0 204 failed: update-dns returned 82 instead of one of [0,204]

So, when I run a "pbis-status" to check if it joined, it looks like it did but I get nothing back:

[root@hostname1 bin]# ./pbis-status
LSA Server Status:

Compiled daemon version: 8.0.1.2029
Packaged product version: 8.0.2031.67578
Uptime:        0 days 22 hours 43 minutes 22 seconds

[Authentication provider: lsa-activedirectory-provider]

        Status:        Unknown
        Mode:          Unknown

When I go into my AD server, I see the server added in the proper OU

[iamteedoh]

So here are more errors I am seeing with the module being ran:

Jun  5 16:03:13 hostname1 lsass: [lsass] Failed to run provider specific request (request code = 12, provider = 'lsa-activedirectory-provider') -> error = 2692, symbol = NERR_SetupNotJoined, client pid = 3332
Jun  5 16:03:14 hostname1 lsass: [lsass] A cell cannot be found, and unprov mode has been disabled by configuration. If you truly wish to use unprov mode, change the cell-support setting to full.
Jun  5 16:03:14 hostname1 lsass: [lsass] Error 40044 occurred while putting an ldap connection back in the domain free list.
Jun  5 16:03:14 hostname1 lsass: [lsass] Failed to run provider specific request (request code = 8, provider = 'lsa-activedirectory-provider') -> error = 40050, symbol = LW_ERROR_NO_SUCH_CELL, client pid = 3339
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[join_domain]/returns) Joining to AD Domain:   mydomain.com
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[join_domain]/returns) With Computer DNS Name: hostname1.mydomain.com
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[join_domain]/returns) Error: LW_ERROR_NO_SUCH_CELL [code 0x00009c72]
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[join_domain]/returns) Failed to find the Cell in Active Directory
Jun  5 16:03:14 hostname1 puppet-agent[2304]: domainjoin-cli join --ou Linux   mydomain.com admin password returned 1 instead of one of [0]
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[join_domain]/returns) change from notrun to 0 failed: domainjoin-cli join --ou Linux   mydomain.com admin password returned 1 instead of one of [0]
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/File[/etc/pbis/pbis.conf]) Dependency Exec[join_domain] has failures: true
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/File[/etc/pbis/pbis.conf]) Skipping because of failed dependencies
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[configure_pbis]) Dependency Exec[join_domain] has failures: true
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[configure_pbis]) Skipping because of failed dependencies
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[clear_ad_cache]) Dependency Exec[join_domain] has failures: true
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[clear_ad_cache]) Skipping because of failed dependencies
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[update_DNS]) Dependency Exec[join_domain] has failures: true
Jun  5 16:03:14 hostname1 puppet-agent[2304]: (/Stage[main]/Pbis/Exec[update_DNS]) Skipping because of failed dependencies
Jun  5 16:03:34 hostname1 puppet-agent[2304]: Finished catalog run in 52.09 seconds

[dionysius]

Ah, there are two possible reasons. I think it's something wrong with the join process, so it might be not a puppet-pbis error. Lets try to debug that. I see the error is called 'LW_ERROR_NO_SUCH_CELL', currently cannot understand what this should mean.

Or, domainjoin maybe hasn't worked because the user has not permission (or accidentally wrong credentials) to add a system (sounds strange to me, because on your AD the system is showing up - but maybe just not completely added).

Anyway what case it is, please try the domainjoin process completely by hand - for debugging purposes.

1. Ensure you've left the AD: domainjoin-cli leave [username] [password] (if it says you're not joined yet, continue with 2)
2. Join AD: domainjoin-cli join [--assumeDefaultDomain {yes|no}] [--userDomainPrefix <short domain name>] [--ou <organizationalUnit>] <domain name> <user name> [<password>]
3. Show me your pbis status output or error output from commands above

And just in case, are on your system the pbis binaries located in /opt/pbis/bin/ too?

[iamteedoh]

Ok, so to answer your question, yep, my binaries are in that locations:

[root@hostname1 packages]# ls /opt/pbis/bin/
ad-cache   del-group       enum-members  find-group-by-id    get-dc-list  gp-admin      klist                 lsa                lwsm         query-member-of        sqlite3
add-group  del-user        enum-objects  find-group-by-name  get-dc-name  gporefresh    ktutil                lwautoenroll-test  mod-group    regshell               uninstall.sh
add-user   domainjoin-cli  enum-users    find-objects        get-dc-time  gprsrtmnt.sh  kvno                  lwcertd            mod-user     samba-interop-install  update-dns
adtool     edit-reg        eventlog-cli  find-user-by-id     get-metrics  kdestroy      ldapsearch            lwio-copy          passwd       setkey-cli             ypcat
config     enum-groups     find-by-sid   find-user-by-name   get-status   kinit         list-groups-for-user  lwio-driver        pbis-status  snmptrap               ypmatch

Here is the output when leaving the domain:

[root@hostname1 packages]# domainjoin-cli leave admin password
Leaving AD Domain:   MYDOMAIN.COM
SUCCESS

However, even if it says it was a success, if I go back to AD, the system is still there and I have to delete it from AD. If not, I can't join again and get the following error if the system already exist in AD:

[root@hostname1 packages]# domainjoin-cli join --assumeDefaultDomain yes --ou Linux mydomain.com admin password
Joining to AD Domain:   mydomain.com
With Computer DNS Name: hostname1.mydomain.com


Error: LW_ERROR_LDAP_INSUFFICIENT_ACCESS [code 0x00009d8b]

Once I delete the system from AD, I am able to join but this is the error I am getting:

[root@hostname1 packages]# domainjoin-cli join --assumeDefaultDomain yes --ou Linux mydomain.com admin password
Joining to AD Domain:   mydomain.com
With Computer DNS Name: hostname1.mydomain.com


Error: LW_ERROR_NO_SUCH_CELL [code 0x00009c72]

Failed to find the Cell in Active Directory

However, if I go to AD and check the Linux OU, I see the system added

[dionysius]

Ok, thats the point I've expected. The same error message appeared this way. So you need to sort out why you are getting this error, because I have no idea what this error means and a short googling didn't help. According to this Installation Guide:

Cell Manager
A snap-in for the Microsoft Management Console to manage cells associated with Active Directory Organizational Units.
There are many things related to 'cells' in this document. Maybe you find out what this means.

But actually I can't help you here anymore. You may now use your enterprise support and contact the vendor for help sorting this out. This issue is now not related to this module anymore.