Join in Active Directory Domain2023/11/10 |
|
Join in Windows Active Directory Domain with Realmd.
This tutorial needs Windows Active Directory Domain Service in your Local Network.
This example is based on the environment like follows.
|
|||||||||||
| [1] | Install required packages. |
|
[root@dlp ~]# dnf -y install realmd sssd oddjob oddjob-mkhomedir adcli samba-common-tools
|
| [2] | Join in Windows Active Directory Domain. |
|
# change DNS setting to refer to AD [root@dlp ~]# nmcli connection modify enp1s0 ipv4.dns 10.0.0.100 [root@dlp ~]# nmcli connection up enp1s0 Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/2) # discover Active Directory domain [root@dlp ~]# realm discover SRV.WORLD srv.world type: kerberos realm-name: SRV.WORLD domain-name: srv.world configured: no server-software: active-directory client-software: sssd required-package: oddjob required-package: oddjob-mkhomedir required-package: sssd required-package: adcli required-package: samba-common-tools # join in Active Directory domain [root@dlp ~]# realm join SRV.WORLD Password for Administrator: # AD Administrator password
# verify possible to get an AD user info [root@dlp ~]# id Serverworld@srv.world uid=581001103(serverworld@srv.world) gid=581000513(domain users@srv.world) groups=581000513(domain users@srv.world) # verify possible to login as an AD user [root@dlp ~]# exit logout Fedora Linux 39 (Server Edition) Kernel 6.5.9-300.fc39.x86_64 on an x86_64 (ttyS0) Activate the web console with: systemctl enable --now cockpit.socket dlp login: Serverworld@srv.world Password: Creating home directory for Serverworld@srv.world. [serverworld@srv.world@dlp ~]$ # logined |
| [3] | If you'd like to omit domain name for AD user, configure like follows. |
|
[root@dlp ~]#
vi /etc/sssd/sssd.conf # line 16 : change use_fully_qualified_names = False
[root@dlp ~]#
[root@dlp ~]# systemctl restart sssd id Administrator uid=581000500(administrator) gid=581000513(domain users) groups=581000513(domain users),581000520(group policy creator owners),581000519(enterprise admins),581000512(domain admins),581000572(denied rodc password replication group),581000518(schema admins) |
| [4] |
AD users UID/GID are assigned randomly, but if you'd like to assign fixed UID/GID, configure like follows.
Add UNIX attributes to AD accounts first, refer to here.
Next, change SSSD settings.
( To add them by PowerShell on CUI, refer to here of [4] ) This example is based on the environment AD accounts have [uidNumber/gidNumber] attributes. |
|
[root@dlp ~]#
vi /etc/sssd/sssd.conf # line 17 : change ldap_id_mapping = False
# add to the end ldap_user_uid_number = uidNumber ldap_user_gid_number = gidNumber # clear cache and restart sssd [root@dlp ~]# rm -f /var/lib/sss/db/* [root@dlp ~]# systemctl restart sssd
id Serverworld uid=2000(serverworld) gid=100(users) groups=100(users) |
|
|