vRA 8.10 join provisioned Linux VM to Active Directory (AD)

[Jinhoe]

Hi, I manage to deploy a Ubuntu VM and it did appeared in the AD. However, the DNS name was blank and I couldn't access the VM with my AD user accounts.

I prepared the vSphere Ubuntu Template using this guide:

https://docs.vmware.com/en/vRealize-Automation/8.10/Using-and-Managing-Cloud-Assembly/GUID-4B121691-7398-4354-AC25-5DEEEA8A9626.html?hWord=N4IghgNiBcIC4FMC2AHCZEgL5A

I suspect could be my template wasn't setup correctly as there are a lot of online information on heavily customizing the template to make it work. I tried those method too but all failed (mostly outdated guide). Hence fall back to the official guide which is much simpler but still couldn't work.

I've been using vRA for about 2 months. Preparing for an air-gap environment project. Please advice.

[Ankush Ankush]

 If you are using Active directory integration with vRA 8.X , It does not join the machine to active directory .
It creates Compute object in specified OU .
If you want to join the VM to domain , you can utilise vSphere CustomSpec , which will add the VM to domain .
Go to
vSphere=> Policy and Profile =>VM Customization Specifications => New
Here is the article , you can skip to guest custom script if you do not need .
https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vm_admin.doc/GUID-9A5093A5-C54F-4502-941B-3F9C0F573A39.html

Once you configure CustomSpec in vCenter then you need to specify Customspec in cloud template.
https://docs.vmware.com/en/vRealize-Automation/8.11/Using-and-Managing-Cloud-Assembly/GUID-87ECCC3B-C3EA-410D-B7E7-D35F7635BAFF.html

[Jinhoe]

 Thanks for your reply. I've tried following the guide but still same result, only creates Compute object in AD.

Do I need to disable the AD integration? Or uninstall cloud-init in the vm template?

I've installed open-vm-tools and perl in the vm template as per the guide. And also enable-custom-script true. I've attached the cloud assembly template for your reference.

[Ankush Ankush]

 Have you configured IP ranges in Network profile in Aria Automation ?
also DNS server , domain and same thing we need to configure in Customspec as well
Also to make sure you have vmtools running on OS

 

 

[Jinhoe]

 Yes, I've configured IP Ranges, AD integration validated successfully. vmtool installed in the ubuntu vm template too. Below is my configuration for customspec and network profile. A little different from yours. If you need more info let me know, I can pm you privately.

[Jinhoe]

 I noticed the domain name in LCM is different from what I've configured in VRA. Does it matter? Is it the reason that VRA has trouble joining the domain? Just so you know the installation was not done by me.

[Ankush Ankush]

 VIDM should not have any issue or link for this , Neither Active directory integration  both are separate things

This could be due to cloud init true which i can think off 

There 2 suggestion I would give 
1. Add your domain in DNS search domain
2. Uninstall the cloud init from appliance --
Basically you can utilise cloud init as well and but for that we need to refer this documentation 
https://cloudinit.readthedocs.io/en/latest/reference/examples.html

I would stick to vSphere custom spec and Network profile thing

expected behaviour is , when we set static IP assignment in cloud template and configured dns search domain and dns server and IP ranges 
VM will get all the details from network profile and implement this on VM , Since we have cloud init custom script config set it may be conflicting with these.

[Jinhoe]

 Hi, I've tried both your suggestions, still can't get it to join domain. I also tried deploying ubuntu directly in vSphere with custom spec also can't work.

I believe linux vm can't join to AD using custom spec since it doesn't have a field to enter the AD credential, but for windows custom spec, there is. Do correct me if I'm wrong.

So what are the options now without going too complicated? Any out-of-the-box solution?

[Ankush Ankush]

I have spent sometime on this , looks like we would need vro or abx to be run on linux machine to make this happen.
like running command of realmd using vro once provisioning is done

[evil242]

I thought that Cloud Config with cloud-init would perform these actions post deployment
Configuration commands in Cloud Assembly templates

 

[Jinhoe]

 Thanks for confirming that. Do you have any guide or reference of using vro or abx to do that?

[Jinhoe]

Finally managed to join domain using SSH Command Workflow in Orchestrator (vRO). However AD credential is stored in cleartext so not completed yet. Anyway I'll bring this topic to vRO.

[evil242]

What are you using to update your DNS records? 

We use Infoblox.  I haven't messed with MSDNS.  But just the AD integration alone to create computer objects won't necessarily add your DNS entry to lookup and ssh to your VM. 

Next issue is working with your template and getting a good script to join to AD.  I don't think the custspec script in vCenter for Linux is the same as the custspec script for Windows. 

You need to work with your linux authentication management (SSD, samba, etc).  We had to jump through a bunch of hoops to get our Linux desktops to join and use AD for authentication.  I would assume it would be a similar process for vRA provisioned Linux VMs. 

Quick search found
https://ubuntu.com/server/docs/service-sssd-ad

 

[Ankush Ankush]

For DNS records creation (C and A name), you can either use ABX action or vRO workflow 
Attaching the sample for abx. 
https://developer.vmware.com/samples/7704/abx-action---dns-record#code

Assuming you know how to map ABX action with subscription and get the necessary details 

[Jinhoe]

 So far I've configured DNS in vRA Network Profile and vSphere custom spec. Is there something I'm missing here? I was able to ssh into the deployed vm and use realm to join domain. I just don't want to do it manually, need automation. That's the whole point.

How did you use the script to join to AD? Will that expose your AD credential?

[evil242]

In VDI, there is a first boot script that runs.

Using vRA 7.6, we had the gugent agent installed in the VM template image.  Then used XaaS software install to run a script that would configure the OS further for things such as joining AD and local package manager.

I am just now working on vRA 8 and haven't gotten to the cloud-init portion yet.  But I assume it will require the cloud-init to automagically run scripts at clone and first boot.  I think our goal however is to get the Linux VM to connect to a RHN Satellite version of Ansible.  Then have the ansible configure SSSD for desired authentication. 

Did the vCenter custom specification script for Linux help configure your VM's machine name and OS hostname?