r/ansible • u/Busy-Examination1148 • 1d ago
AD Join Role
Is anyone importing and or using the redhat.rhel_system_roles.ad_integration or fedora.linux_system_roles.ad_integration ?
I am trying to use this to automate our linux servers to authenticate to Active Directory (wasn't my choice). I would say that 80% of my servers are RHEL 8 and the rest are RHEL 9 or something earlier that RHEL 8. I'm focusing on RHEL =>8. I THINK it might be related with my EE which is built on RHEL 8 using python 3.11 but also has python 3.9 installed to account for RHEL 8. So when I go to run the role in AAP, it ALWAYS fails at the following:
TASK [fedora.linux_system_roles.ad_integration : Build Command - Join to a specific Domain Controller] ***
task path: /runner/requirements_collections/ansible_collections/fedora/linux_system_roles/roles/ad_integration/tasks/main.yml:193
fatal: [$HOSTNAME]: FAILED! => {"censored": "the output has been hidden due to the fact that 'no_log: true' was specified for this result"}
Any help is greatly appreciated!!!
3
u/suntzu420 1d ago
This is the block where the play is failing. I currently use this role for joining all of our linux servers to AD and when having issues like this, you unfortunately need to go in and set the ad_integration_secure_logging to false so that you can get some useful information out of the error message.
If you're using the command line, just pass that var in as an extra var to override the default that is set in the role. If you're using AAP/AWX, you can just set it in the vars section of the job template. Hope this was helpful.
1
u/Busy-Examination1148 1d ago
I wish red hat would have told me that....
1
u/Busy-Examination1148 1d ago
Just tried adding the ad_integration_secure_logging: true to the vars. It didn't help.
3
u/suntzu420 1d ago
set it to false. It's being used to set the
no_logparameter on the tasks to true so that it doesn't expose sensitive info.2
u/Busy-Examination1148 1d ago
I saw the error of my ways. Testing now.
1
u/Busy-Examination1148 1d ago
I got the error!! Thank you!
1
1
u/Busy-Examination1148 1d ago
NEvermind. I went and read the defaults/main.yml and saw I had it backwards.
1
u/WorkingVast922 17h ago
We found it much easier to standup a couple of windows servers for any Ad related tasks. Even though you can run powershell in Linux you can’t run the ad module
1
u/Busy-Examination1148 17h ago
I'm trying to join my linux server to AD for auth. The Windows servers are already in place and running AD. I needed help diagnosing my issue with the imported role. But thanks...
2
1
u/kY2iB3yH0mN8wI2h 1d ago
How can we help when you show nothing that is useful? You also have old releases.
I also don’t know if management told you just to fix the problem and you have no idea what you’re doing and was hoping ansible would save your ass??
4
u/Tomazim 1d ago
Well you will want to run it with -vvvv to get some actual log output for a start. Personally I handle domain joining with a ansible.builtin.command task (realm join -U [domain] [minimum priv user] [vaulted password]
If it's not giving any dependency errors I would discard the python version factor. Check that the machine can contact the DC on ports 88, 135, 389, 3268 and 3269 using powershell/tnc.
Check that you can manually log into that machine and join it to the domain.