Join in Active Directory Domain2021/02/23 |
|
Join in Windows Active Directory Domain with Realmd.
This tutorial needs Windows Active Directory Domain Service in your Local Network.
This example is based on the environment like follows.
|
|||||||||||
| [1] | Install required packages. |
|
[root@dlp ~]# dnf -y install realmd sssd oddjob oddjob-mkhomedir adcli samba-common-tools krb5-workstation
|
| [2] | Join in Windows Active Directory Domain. |
|
# change DNS setting to refer to AD [root@dlp ~]# nmcli connection modify enp1s0 ipv4.dns 10.0.0.100 [root@dlp ~]# nmcli connection down enp1s0; nmcli connection up enp1s0 Connection 'enp1s0' successfully deactivated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/1) Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/2) # discover Active Directory domain [root@dlp ~]# realm discover SRV.WORLD srv.world type: kerberos realm-name: SRV.WORLD domain-name: srv.world configured: no server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common-tools # join in Active Directory domain [root@dlp ~]# realm join SRV.WORLD Password for Administrator: # AD Administrator password
# verify possible to get an AD user info or not [root@dlp ~]# id Serverworld@srv.world uid=691201105(serverworld@srv.world) gid=691200513(domain users@srv.world) groups=691200513(domain users@srv.world),691200572(denied rodc password replication group@srv.world),691200512(domain admins@srv.world) # verify possible to login as an AD user or not [root@dlp ~]# logout CentOS Stream 8 Kernel 4.18.0-240.el8.x86_64 on an x86_64 Activate the web console with: systemctl enable --now cockpit.socket dlp login: Serverworld@srv.world Password: [serverworld@srv.world@dlp ~]$ # logined |
| [3] | If you'd like to omit domain name for AD user, configure like follows. |
|
[root@dlp ~]#
vi /etc/sssd/sssd.conf # line 16: change use_fully_qualified_names = False
[root@dlp ~]#
[root@dlp ~]# systemctl restart sssd id Administrator uid=891000500(administrator) gid=891000513(domain users) groups=891000513(domain users),891000572(denied rodc password replication group),891000519(enterprise admins),891000512(domain admins),891000518(schema admins),891000520(group policy creator owners) |
| [4] |
AD users UID/GID are assigned randomly, but if you'd like to assign fixed UID/GID, configure like follows.
Add UNIX attributes to AD accounts first, refer to here.
Next, change SSSD settings.
( To add them by PowerShell on CUI, refer to here of [4] ) This example is based on the environment AD accounts have [uidNumber/gidNumber] attributes. |
|
[root@dlp ~]#
vi /etc/sssd/sssd.conf # line 15 : change ldap_id_mapping = False
# add to the end ldap_user_uid_number = uidNumber ldap_user_gid_number = gidNumber # clear cache and restart sssd [root@dlp ~]# rm -f /var/lib/sss/db/* [root@dlp ~]# systemctl restart sssd
id serverworld uid=5000(serverworld) gid=5000(linuxgroup) groups=5000(linuxgroup) |
| Sponsored Link |