Debian 11通过Ansible加入AD遇Conditional result was False问题求助

我一直在排查来自wolffhaven的Ansible Playbook加入AD域的任务，但始终没有进展。遇到的错误如下：

TASK [domain_join : Join system to AD]
******************************************************************************************************************************************************************************************************************************************************** task path:
/etc/ansible/playbooks/ansible-realmd/roles/domain_join/tasks/main.yml:82
skipping: [10.112.2.183] => {
"changed": false,
"skip_reason": "Conditional result was False"
}

相关任务代码：

- name: Join system to AD
  expect:
    command: /usr/sbin/realm join --membership-software=adcli {{ realm_domain }} --computer-ou='{{ realm_ad_ou }}' --user={{ kerberos_user }}
    responses:
      (?i)Password: "{{ kerberos_user_password }}"
  ignore_errors: yes
  when: realm_list_results.stdout == ""
  become: true
  tags: adjoin

完整Role代码：

---
# tasks that run after a new deployment

- name: Load Secrets
  include_vars: "secrets.yml"

- name: Load Variables
  include_vars: "vars.yml"

- name: Install pip
  apt: 
    name: python3-pip
    state: present
    update_cache: yes

- name: Install pexpect
  pip: 
    name: pexpect
    state: present  

- name: Install AD Domain packages
  apt: 
    name: "{{ item }}"
    state: present 
    update_cache: yes
  with_items:
    - realmd
    - sssd
    - adcli
    - krb5-user
    - sssd-tools
    - samba-common
    - packagekit
    - samba-common-bin
    - samba-libs
  tags: ad

- name: Copy realmd.conf
  template: 
    src: realmd.conf.j2
    dest: /etc/realmd.conf
    owner: root
    group: root
    mode: 0644
  tags: ad

- name: Copy krb5.conf
  template: 
    src: krb5.conf.j2
    dest: /etc/krb5.conf
    backup: yes
    owner: root
    group: root
    mode: 0644
  tags: ad

- name: Discover realm
  command: /bin/bash -c "/usr/sbin/realm discover {{ realm_domain }}"
  register: realm_discover_results
  tags: ad

- name: Discover realm debug
  debug: 
    msg: "{{ realm_discover_results.stdout }}"

- name: Create kerberos ticket
  expect:
    command: /bin/bash -c "/usr/bin/kinit -V {{ kerberos_user }}"
    responses:
      (?i)Password: "{{ kerberos_user_password }}"
  tags: ad

- name: Checking to see if system is already joined to AD
  command: /bin/bash -c "/usr/sbin/realm list"
  register: realm_list_results
  tags: adlist

- name: Debug realm_list_results
  debug:
    msg: "{{ realm_list_results.stdout }}"

- name: Join system to AD
  expect:
    command: /usr/sbin/realm join --membership-software=adcli {{ realm_domain }} --computer-ou='{{ realm_ad_ou }}' --user={{ kerberos_user }}
    responses:
      (?i)Password: "{{ kerberos_user_password }}"  
  ignore_errors: yes
  when: realm_list_results.stdout == ""
  become: true
  tags: adjoin

- name: Copy suders file for safety
  command: cp -f /etc/sudoers /etc/sudoers.tmp

- name: Create sudoers file backup
  command: cp -f /etc/sudoers /etc/sudoers.bak

- name: Add domain admins group to sudoers
  lineinfile: dest=/etc/sudoers.tmp state=present line='%domain\ admins ALL=(ALL:ALL) ALL' regexp='^%domain'

- name: Final sudoers file check
  shell: visudo -q -c -f /etc/sudoers.tmp && cp -f /etc/sudoers.tmp /etc/sudoers

- name: Copy sssd.conf
  template:
    src: sssd.conf.j2
    dest: /etc/sssd/sssd.conf
    owner: root
    group: root
    mode: 0644
  tags: ad

- name: Copy pam common-session
  template: 
    src: common-session.j2
    dest: /etc/pam.d/common-session
    owner: root
    group: root
    mode: 0644
  tags: ad

排查方向与解决建议 #

1. 检查realm list输出：直接在目标主机执行/usr/sbin/realm list，确认主机是否已加入AD域，或命令是否返回错误信息、空行以外的内容，这是任务跳过的核心原因。
2. 查看Debug输出：查看Playbook中Debug realm_list_results任务的输出，明确realm_list_results.stdout的具体值，判断条件不成立的具体原因。
3. 优化判断条件：将when: realm_list_results.stdout == ""修改为when: realm_domain not in realm_list_results.stdout，避免因命令返回非空无关内容导致任务跳过。
4. 验证前置步骤：确认realm discover能正常发现AD域，kinit能成功获取Kerberos票据，前置步骤失败会导致后续加入任务无法正常执行。
5. 检查变量有效性：确认secrets.yml和vars.yml中的realm_domain、realm_ad_ou、kerberos_user等变量已正确加载且不为空。

内容的提问来源于stack exchange，提问作者nfoman