Home / server / Questions / 1044968
In Process
jamboNum5
Asked: 2020-12-05 04:03:41 +0800 CST

adcli fails to join AD with LDAPS option

  • 772

Having issues with the adcli on ubuntu 18.04 which was updated recently with the ldaps option.

It can't seem to find the shortname for AD and also doesn't manage to connect to LDAP even when the CA is specified in the command and with /etc/ldap/ldap.conf

Have also tried to configure the ldap_uri in the SSSD config with no luck there either.

me@lnx-node-1:~# LDAPTLS_CACERT=/usr/local/share/ca-certificates/domain-ca.pem adcli join -U me-admin --domain=ad.somewhere.com -v
     * Using domain name: AD.SOMEWHERE.COM
     * Calculated computer account name from fqdn: LNX-NODE-1
     * Calculated domain realm from name: AD.SOMEWHERE.COM
     * Discovering domain controllers: _ldap._tcp.AD.SOMEWHERE.COM
     * Sending netlogon pings to domain controller: ldap://[####:650:###:d314::dc1]
     * Sending netlogon pings to domain controller: cldap://####.###.160.19
     * Sending netlogon pings to domain controller: ldap://[####:630:###:d314::dc4]
     * Sending netlogon pings to domain controller: cldap://###.###.160.59
     * Sending netlogon pings to domain controller: ldap://[####:630:###:e010::dc2]
     * Received NetLogon info from: itsdc-1.ad.somewhere.com
     * Wrote out krb5.conf snippet to /tmp/adcli-krb5-H8CKiH/krb5.d/adcli-krb5-conf-vv3c80
    Password for [email protected]: 
     * Authenticated as user: [email protected]
     * Using GSS-SPNEGO for SASL bind
     * ! Couldn't lookup domain short name: Can't contact LDAP server
     * Using fully qualified name: lnx-node-1.ad.somewhere.com
     * Using domain name: AD.SOMEWHER.COM
     * Using computer account name: LNX-NODE-1
     * Using domain realm: AD.SOMEWHER.COM
     * Calculated computer account name from fqdn: LNX-NODE-1
     * Generated 120 character computer password
     * Using keytab: FILE:/etc/krb5.keytab
     ! Couldn't lookup computer account: LNX-NODE-1$: Can't contact LDAP server
    adcli: joining domain AD.SOMEWHERE.COM failed: Couldn't lookup computer account: LNX-NODE-1$: Can't contact LDAP server

UPDATE : Managed a temporary workaround downgrading the adcli packages apt install adcli=0.8.2-1, still need a fix.

active-directory ubuntu-18.04 sssd

1 Answers

  1. Looks like there is a reported issue here:

    https://bugs.launchpad.net/ubuntu/bionic/+source/adcli/+bug/1906627

    apt is no longer installing the broken version (0.8.2-1ubuntu1) of this package.

    apt-cache policy adcli
adcli:
  Installed: 0.8.2-1
  Candidate: 0.8.2-1
  Version table:
 *** 0.8.2-1 500
        500 http://gb.archive.ubuntu.com/ubuntu bionic/universe amd64 Packages
        100 /var/lib/dpkg/status
    • 0