Fedora should be able to be used on an Active Directory domain (or IPA realm) out of the box. Simple joining of these domains, and authenticating to them.
This feature will also increase reliability and ease usage for any Kerberos realm, not just Active Directory. We do however target Active Directory as the main use case as it's by far the most widely deployed Kerberos realm and directory.
- Name: Stef Walter
- Email: email@example.com
- Targeted release: Fedora 18
- Last updated: 2012-05-25
- Percentage of completion: 20%
Fedora should work out of the box in an Active Directory environment. Currently many tools are there to accomplish this, but it takes a genius to get all aspects working correctly and securely.
First of all this feature fixes bugs and tough spots present in kerberos libraries, sssd, authconfig, openldap, samba, winbind, GUI, as necessary. We also remove configuration headaches. Some examples here, more details available on request:
- Allow configurationless kerberos. Remove /etc/krb5.conf file requirement, and unbreak defaults.
- Remove NTP requirement for kerberos clients.
- Correctly show kerberos password change policy messages.
- Respect kerberos password policy for kerberos accounts instead of local policy.
- Make SSSD work without modifications to the Active Directory domain.
- Fix authconfig so it doesn't break config files.
- Fix SELinux policies so which prevent this stuff from working out of the box.
Secondly the GUI will be updated to support kerberos logins better:
- GDM will give hints as to how to log in with domain credentials (once configured).
- Automatically renew tickets when possible and/or reprompt for credentials when they expire.
Thirdly, and equally important, we streamline the enrollment process for joining a machine to an Active Directory domain. In the process we also easy configuration of IPA kerberos domains. In these streamlined setups we auto-discover all necessary configuration parameters, only a domain name is needed.
Gnome Control Center will be updated to allow configuring logins for Active Directory users from the GUI. Firstboot and/or Initial Setup will be modified to allow setup of Active Directory logins. New command line tools will also be available to drive this streamlined enrollment process.
The above streamlined setup is driven by a dbus system service called realmd started on demand. This service allows multiple providers (such as winbind or sssd). It is also an upstream project and not just Red Hat specific.
Benefit to Fedora
- Fedora will be simple to use on an Active Directory domain or IPA realm. This will increase its appeal among enterprise users.
- By using SSSD we will have reliable offline usage (eg: laptop) for users logging in with a kerberos login.
- Most of these changes and fixes will increase reliability and ease usage for all kerberos realms, not just Active Directory. We simply target Active Directory as the main use case as it's by far the most widely deployed kerberos server.
- Most users who have configured pam_krb5 + nss_ldap are doing so in a secure way, which is trivially hackable by anyone with access to the network. My making it simple enroll the machine correctly, and using sssd, we will increase security for kerberos users.
This is a large change which touches many packages. There are many people on board with this effort and are already working hard to make it happen, most in upstream projects.
- Many many bug fixes (of which many have already been fixed upstream as a result of this effort).
- SSSD will gain support for Active Directory (already in progress).
- Firstboot modifications to integrate realmd and streamlined setup.
- GNOME modifications to integrate use of kerberos and its configuration.
- Complete work on realmd for streamlined setup (much already done).
How To Test
To perform testing one will need to have an Active Directory domain or IPA realm accessible to you. You'll need a user account on that domain. To enroll your machine you'll probably need administrative credentials for the domain (or assistance from an administrator of the domain).
The goal is for this stuff to work out of the box. Necessary packages should either already be installed, or should be installed for you while enrolling the machine.
You should be able to setup domain logins from Firstboot or Initial Setup. You should be able to setup domain logins from the Users panel in Gnome Control Center. Once configured you should be able to login at GDM with you domain credentials.
Your kerberos tickets should be tracked by GNOME and either automatically renewed (when possible) or you should be reprompted for your domain credentials as necessary.
All of the above should function without fiddling with configuration files, or knowing details of the domain (other than its name, and relevant domain credentials).
Admins and users will see a simplified experience for configuring kerberos when running Fedora install. Users will see simple options for using domain logins in the control center. Users who have configured kerberos logins will see hints during login for how to use their domain credentials. They will be reprompted as necessary for expiring credentials.
But above all, the goal here is to not have unnecessary "user experience" and to have stuff just work.
There are dependencies in at least the following:
Because this feature is about integration it touches a large amount of packages. We've been proactive in making sure to work with upstream developers, and are already making solid progress.
- The myriad of kerberos related bug fixes stand on their own. And are being merged as complete.
- The GNOME changes will disable themselves at run time should the underlying stuff not be present.
- If SSSD Active Directory changes are not ready in time, realmd can configure Winbind instead.
- Design of the GNOME feature is ongoing and can be seen [], [], and [].
- More documentation is forthcoming.
- Documentation for GNOME 3.6 will include notes about this feature when its merged.
- Other release notes will be forthcoming.