{"id":15511638,"url":"https://github.com/rnelson0/puppet-domain_join","last_synced_at":"2025-04-23T03:12:21.629Z","repository":{"id":57666010,"uuid":"54201928","full_name":"rnelson0/puppet-domain_join","owner":"rnelson0","description":"Provides just enough configuration to join a Linux node to an Active Directory domain.","archived":false,"fork":false,"pushed_at":"2019-12-27T18:28:32.000Z","size":78,"stargazers_count":1,"open_issues_count":4,"forks_count":4,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-21T20:03:03.544Z","etag":null,"topics":["puppet-module"],"latest_commit_sha":null,"homepage":null,"language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rnelson0.png","metadata":{"files":{"readme":"README.markdown","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-03-18T13:10:41.000Z","updated_at":"2019-12-27T18:28:14.000Z","dependencies_parsed_at":"2022-09-26T20:31:34.103Z","dependency_job_id":null,"html_url":"https://github.com/rnelson0/puppet-domain_join","commit_stats":null,"previous_names":[],"tags_count":10,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rnelson0%2Fpuppet-domain_join","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rnelson0%2Fpuppet-domain_join/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rnelson0%2Fpuppet-domain_join/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rnelson0%2Fpuppet-domain_join/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rnelson0","download_url":"https://codeload.github.com/rnelson0/puppet-domain_join/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250360502,"owners_count":21417721,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["puppet-module"],"created_at":"2024-10-02T09:53:09.202Z","updated_at":"2025-04-23T03:12:21.609Z","avatar_url":"https://github.com/rnelson0.png","language":"Ruby","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![Build Status](https://travis-ci.org/rnelson0/puppet-domain_join.png?branch=master)](https://travis-ci.org/rnelson0/puppet-domain_join)\n[![Puppet Forge](http://img.shields.io/puppetforge/v/rnelson0/domain_join.svg)](https://forge.puppetlabs.com/rnelson0/domain_join)\n[![Puppet Forge Downloads](http://img.shields.io/puppetforge/dt/rnelson0/domain_join.svg)](https://forge.puppetlabs.com/rnelson0/domain_join)\n[![Stories in Ready](https://badge.waffle.io/rnelson0/puppet-domain_join.svg?label=Ready\u0026title=Ready)](http://waffle.io/rnelson0/puppet-modules)\n[![Stories In Progress](https://badge.waffle.io/rnelson0/puppet-domain_join.svg?label=in%20progress\u0026title=In%20Progress)](http://waffle.io/rnelson0/puppet-modules)\n\n#### Table of Contents\n\n1. [Overview](#overview)\n2. [Module Description - What the module does and why it is useful](#module-description)\n3. [Setup - The basics of getting started with domain_join](#setup)\n    * [What domain_join affects](#what-domain_join-affects)\n    * [Beginning with domain_join](#beginning-with-domain_join)\n4. [Usage - Configuration options and additional functionality](#usage)\n5. [Limitations - OS compatibility, etc.](#limitations)\n6. [Creating a Least Privilege account](#creating-a-least-privilege-account)\n\n## Overview\n\nProvide the most minimal configuration required to allow a Linux node to join a Windows domain.\n\n## Module Description\n\nThis module is intended for the lazy Linux admin who wants their Linux nodes to join a Windows domain without needing to manage the components. Rather than managing SSSD, Samba, and Kerberos, just manage \"the ability to join a domain\"!\n\nUnfortunately, if you want to manage those services separately, this module may not be perfect fit for you. You may skip the service and resolver configuration by setting one or both of `manage_services` and `manage_resolver` to false.\n\n## Setup\n\n### What domain_join affects\n\n* DNS resolution through `/etc/resolv.conf` unless `manage_resolver` is false.\n* SSSD, Samba, and Kerberos configs (`/etc/sssd/sssd.conf`, `/etc/samba/smb.conf`, `/etc/krb5.conf`) unless `manage_services` is false.\n* A domain join shell script at `/usr/local/bin/domain_join`, that includes credentials used to join the domain.\n    * It is *highly* recommended that you follow the [Principle of Least Privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilegehttps://en.wikipedia.org/wiki/Principle_of_least_privilege) and do *not* use a Domain Admin account or similar. See [Creating a Least Privilege Account](#creating-a-least-privilege-account) for more information.\n\n\n### Beginning with domain_join\n\n    # Without hiera\n    class { 'domain_join':\n      domain_fqdn               =\u003e 'example.com',\n      domain_shortname          =\u003e 'example',\n      ad_dns                    =\u003e ['10.0.0.1', '10.0.0.2'],\n      register_account          =\u003e 'domainjoin',\n      register_password         =\u003e 'Sup4rS3krEt',\n      additional_search_domains =\u003e ['web.example.com', 'b2b.example.com'],\n    }\n\n    # With Hiera\n    # Manifest:\n    include domain_join\n    \n    # Hiera yaml:\n    ---\n    domain_join::domain_fqdn: example.com\n    domain_join::domain_shortname: example\n    domain_join::ad_dns:\n      - 10.0.0.1\n      - 10.0.0.2\n    domain_join::register_account: domainjoin\n    domain_join::register_password: 'Sup4rS3krEt'\n    domain_join::additional_search_domains:\n      - web.example.com\n      - b2b.example.com\n\n## Usage\n\nFollow the above reference for simple domain joins. You can control the service and resolver configuration with two booleans:\n    class { 'domain_join':\n        ... # other options\n        manage_services =\u003e false,\n        manage_resolver =\u003e false,\n    }\n\n    ---\n    domain_join::manage_services: false\n    domain_join::manage_resolver: false\n\nAdditional configuration options include:\n\n`createcomputer`: Name of the AD container to join the new node to, typically an OU or a built-in container object.\n\n## Limitations\n\nThis module may cause duplicate resource errors if used in the same catalog as any module that directly manages sssd, samba, or kerberos packages or configs unless `manage_services` is false. See the compatibility tab or [metadata.json](metadata.json) for tested OS support.\n\n## Creating a Least Privilege account\nIt is highly recommended that the `register_account` be an account that has the ability to join computers to domains and nothing else. The following is an overly simplistic method to create such a user. This is suitable for a lab but may need further review for use in production. Use at your own risk.\n* Create an account, ex: **domainjoin**, in the appropriate hierarchy of your Active Directory. It is recommend that **User cannot change password** and **Password never expires** are selected.\n* Delegate the ability to manage computer objects to the user with the *Active Directory Users and Computers* snap in (from [JSI Tip 8144](http://windowsitpro.com/windows-server/jsi-tip-8144-how-can-i-allow-ordinary-user-add-computer-domain) with tweaks).\n * Open the *Active Directory Users and Computers* snap-in.\n * Right click the container under which you want the computers added (ex: `Computers`) and choose *Delegate Control*.\n * Click *Next*.\n * Click *Add* and supply your user account(s), e.g **domainjoin**. Click *Next* when complete.\n * Select *Create custom task to delegate* and click *Next*.\n * Select *Only the following objects in the folder* and then *Computer objects*. Click *Next*.\n * Under **Permissions**, check *Create All Child Objects* and *Write All Properties*. Click *Next*.\n * Click *Finish*\n\nYou may also need to run the following command to [increase the Machine Account Quota to a very large number](https://technet.microsoft.com/en-us/library/dd391926%28v=ws.10%29.aspx). This represents the number of machines a user can join to the domain and defaults to 10 for the domain. This can only be set at the domain level.\n\n    Set-ADDomain example.com -Replace @{\"ms-ds-MachineAccountQuota\"=\"10000\"}\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frnelson0%2Fpuppet-domain_join","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frnelson0%2Fpuppet-domain_join","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frnelson0%2Fpuppet-domain_join/lists"}