For starters I have several Ubuntu servers successfully joined to the domain for the servers that sit in the same subnet as the DCs. However, I'm working to join a few Ubuntu machines through haproxy but running into an odd error that has me stuck at the moment. Worrying about auth flapping I disabled one of the DCs through haproxy for now.
frontend DC bind *:389 bind *:636 bind *:88 bind *:464 mode tcp option tcplog default_backend DC_Backend backend DC_Backend mode tcp server dc1 X.X.X.21
All in all connectivity all seems good.
On the server I'm connecting from I'm authing with the same creds as I have successfully done so inside the network. Also, I've added the int.domain.com IP in
/etc/hosts to point to the proxy's IP address (Y.Y.Y.20 int.domain.com)
realm join -U linux_ad_admin --computer-ou="OU=LinuxServers,OU=Servers,OU=IT_Systems" int.domain.com --verbose
* Resolving: _ldap._tcp.int.domain.com * Resolving: int.domain.com * Performing LDAP DSE lookup on: Y.Y.Y.20 * Successfully discovered: int.domain.com Password for linux_ad_admin: * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/sbin/adcli * LANG=C /usr/sbin/adcli join --verbose --domain int.domain.com --domain-realm INT.DOMAIN.COM --domain-controller Y.Y.Y.20 --computer-ou OU=LinuxServers,OU=Servers,OU=IT_Systems,dc=int,dc=domain,dc=com --login-type user --login-user linux_ad_admin --stdin-password * Using domain name: int.domain.com * Calculated computer account name from fqdn: DMZHOSTTEST1 * Using domain realm: int.domain.com * Sending NetLogon ping to domain controller: Y.Y.Y.20 * Wrote out krb5.conf snippet to /var/cache/realmd/adcli-krb5-llM0zh/krb5.d/adcli-krb5-conf-qOXHOs * Authenticated as user: linux_ad_admin@INT.DOMAIN.COM * Using GSS-SPNEGO for SASL bind ! Couldn't authenticate to active directory: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database) adcli: couldn't connect to int.domain.com domain: Couldn't authenticate to active directory: SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (Server not found in Kerberos database) ! Insufficient permissions to join the domain realm: Couldn't join realm: Insufficient permissions to join the domain
Any idea what I'm missing here? This same command/account joins the servers to the AD no problem while in the same subnet. But going through the proxy is suddenly giving me the insufficient permissions error. Are additional open ports needed to go through haproxy?