无法指定的计算机账户,领域加入无法创建计算机帐户

Reading man realm I see the following:

--computer-ou=OU=xxx

The distinguished name of an organizational unit to create the computer account. The exact format of the distinguished name depends on the

membership software. You can usually omit the root DSE portion of distinguished name. This is an Active Directory specific option.

I interpret that as realm beeing able to create a computer account as needed in active directory.

进行测试但失败了：

[root@client ~]# realm join --user=svc-linux-join --computer-ou=OU=servers,OU=linux,DC=domain,DC=bls --os-name=CentOS --os-version=7 --automatic-id-mapping=no domain.bls <

Password for svc-linux-join:

See: journalctl REALMD_OPERATION=r1695.2763

realm: Couldn't join realm: Joining the domain domain.bls failed

[root@client ~]# journalctl REALMD_OPERATION=r1695.2763

-- Logs begin at Thu 2019-09-19 22:00:08 CEST, end at Thu 2019-09-19 22:28:25 CEST. --

Sep 19 22:28:25 client realmd[2759]: * Resolving: _ldap._tcp.domain.bls

Sep 19 22:28:25 client realmd[2759]: * Performing LDAP DSE lookup on: 10.0.2.15

Sep 19 22:28:25 client realmd[2759]: * Successfully discovered: domain.bls

Sep 19 22:28:25 client realmd[2759]: * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net

Sep 19 22:28:25 client realmd[2759]: * LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.2B8L8Z -U svc-linux-join ads join domain.bls createcomputer=linux/serve

Sep 19 22:28:25 client realmd[2759]: Enter svc-linux-join's password:

Sep 19 22:28:25 client realmd[2759]: Failed to join domain: failed to precreate account in ou ou=servers,ou=linux,dc=DOMAIN,dc=BLS: No such object

Sep 19 22:28:25 client realmd[2759]: ! Joining the domain domain.bls failed

I first believed it to be a limitation of the privileges delegated to svc-linux-join so I let administrator@domain.bls have a go as well, same result:

[root@client ~]# realm join --computer-ou=OU=servers,OU=linux,DC=domain,DC=bls --os-name=CentOS --os-version=7 --automatic-id-mapping=no domain.bls

Password for Administrator:

See: journalctl REALMD_OPERATION=r1740.2772

realm: Couldn't join realm: Joining the domain domain.bls failed

[root@client ~]# journalctl REALMD_OPERATION=r1740.2772

-- Logs begin at Thu 2019-09-19 22:00:08 CEST, end at Thu 2019-09-19 22:29:14 CEST. --

Sep 19 22:29:11 client realmd[2759]: * Resolving: _ldap._tcp.domain.bls

Sep 19 22:29:11 client realmd[2759]: * Performing LDAP DSE lookup on: 10.0.2.15

Sep 19 22:29:11 client realmd[2759]: * Successfully discovered: domain.bls

Sep 19 22:29:14 client realmd[2759]: * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net

Sep 19 22:29:14 client realmd[2759]: * LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.UK8T8Z -U Administrator ads join domain.bls createcomputer=linux/server

Sep 19 22:29:14 client realmd[2759]: Enter Administrator's password:

Sep 19 22:29:14 client realmd[2759]: Failed to join domain: failed to precreate account in ou ou=servers,ou=linux,dc=DOMAIN,dc=BLS: No such object

Sep 19 22:29:14 client realmd[2759]: ! Joining the domain domain.bls failed

然后，我尝试预创建计算机帐户：

并再次加入：

[root@client ~]# realm join --user=svc-linux-join --computer-ou=OU=servers,OU=linux,DC=domain,DC=bls --os-name=CentOS --os-version=7 --automatic-id-mapping=no domain.bls <

Password for svc-linux-join:

See: journalctl REALMD_OPERATION=r2567.12844

realm: Couldn't join realm: Insufficient permissions to join the domain domain.bls

[root@client ~]# journalctl REALMD_OPERATION=r2567.12844

-- Logs begin at Thu 2019-09-19 22:00:08 CEST, end at Thu 2019-09-19 22:47:21 CEST. --

Sep 19 22:42:58 client realmd[12848]: * Resolving: _ldap._tcp.domain.bls

Sep 19 22:42:58 client realmd[12848]: * Performing LDAP DSE lookup on: 10.0.2.15

Sep 19 22:42:58 client realmd[12848]: * Successfully discovered: domain.bls

Sep 19 22:42:58 client realmd[12848]: * Required files: /usr/sbin/oddjobd, /usr/libexec/oddjob/mkhomedir, /usr/sbin/sssd, /usr/bin/net

Sep 19 22:42:58 client realmd[12848]: * LANG=C LOGNAME=root /usr/bin/net -s /var/cache/realmd/realmd-smb-conf.F0897Z -U svc-linux-join ads join domain.bls createcomputer=linux/serv

Sep 19 22:42:58 client realmd[12848]: Enter svc-linux-join's password:

Sep 19 22:42:58 client realmd[12848]: Failed to join domain: Failed to set password for machine account (NT_STATUS_ACCESS_DENIED)

Sep 19 22:42:58 client realmd[12848]:

Sep 19 22:42:58 client realmd[12848]: ! Insufficient permissions to join the domain domain.bls

现在，该帐户已存在，我得到另一个错误。以管理员身份返回：

[root@client ~]# realm join --computer-ou=OU=servers,OU=linux,DC=domain,DC=bls --os-name=CentOS --os-version=7 --automatic-id-mapping=no domain.bls

Password for Administrator:

它只是工作。

如果我删除计算机帐户并重新加入域而不为计算机帐户指定所需的OU，则它也可以正常工作：

[root@client ~]# realm leave --remove

Password for Administrator:

[root@client ~]# realm join domain.bls

Password for Administrator:

[root@client ~]# ldapsearch -LLL -x -h server -b dc=domain,dc=bls -D svc-linux-join -w L3t-m3-in cn=client distinguishedName | grep -v -e ^# -e ^$

dn: CN=client,CN=Computers,DC=domain,DC=bls

distinguishedName: CN=client,CN=Computers,DC=domain,DC=bls

Should I not be able to let realm join create computer accounts in a specified OU using the account with delegated privileges to the OU?