Join the current machine to an Active Directory domain using sssd as an AD client, without entering administrative credentials.
- Due to this bug with discussion here, you need to have
/etc/nsswitch.confwhen you last booted you system. To do so run this:
$ sudo authconfig --update --enablesssd; sudo shutdown -r now
- You need control-center 3.6.2 version.
- Verify that your Active Directory domain access works. If you don't have an Active Directory domain, you can set one up.
- You need a domain user account and administrator account, or both. If you have both, enter the use account as the user you're going to add below.
- Your machine must have a configured host name. Do not proceed if you host name is
- Make sure you have realmd 0.10 or later installed.
$ yum list realmd
- Remove the following packages, they should be installed by realmd as necessary.
$ yum remove sssd samba-client adcli
- Make sure you are not joined to a domain. Use
realm listto check, and
realm leaveto leave.
How to test
gnome-control-centerfrom a terminal.
- Choose the User Accounts panel.
- Click the Unlock button.
- You should get a Policy Kit authorization prompt.
- Click the add [+] button in the lower left.
- Choose the Enterprise login pane.
- Enter an invalid domain, invalid user, and invalid password for the account.
- Click on Add. You should see a problem icon on the domain.
- Enter the valid domain, invalid user, and invalid password for the account.
- Click on Add. You should see a problem icon on the user.
- Enter the valid domain, valid user, and invalid password for the account.
- Click on Add. You should see a problem icon on the password.
- Enter the right password.
- Click on Add
- If you user a non-administrative user, you may be prompted for administrative credentials. It is tricky to duplicate this at times. Active Directory is an odd one like that :)
- The user should now be listed in the User Accounts panel of the GNOME Control Center.
- Check that the domain is now configured.
$ realm list
- Make sure the domain is listed.
- Make sure you have a
configured: kerberos-membershipline in the output.
- Make note of the
login-formatsline for the next command.
- Check that you can resolve domain accounts on the local computer.
$ getent passwd 'AD\User'
- Make sure to use the quotes around the user name.
- You should see an output line that looks like passwd(5) output. It should contain an appropriate home directory, and a shell.
- Use the
login-formatsyou saw above, to build a remote user name. It will be in the form of
DOMAIN\User, where DOMAIN is the first part of your full Active Directory domain name.
- Check that you have an appropriate entry in your hosts keytab.
sudo klist -k
- You should see several lines, with your host name. For example
- Check that you can use your keytab with kerberos
sudo kinit -k 'HOSTNAME$@AD.EXAMPLE.COM'
- Make sure to use quotes around the argument, because of the characters in there. Make sure the hostname and domain are capitalized.
- Use the principal from the output of the
klistcommand above. Use the one that's capitalized and looks like
- There should be no output from this command.
- The user should show up here:
$ realm list
- Look at the
- You should also see
- Go to GDM by logging out, or by Switch User from the user menu.
- Choose the Not Listed? option.
- Verify that you can see the short name listed with a hint as to how to log in.
DOMAIN\Userin the box.
- The case of the domain and user should not matter, but they are separated by a backslash.
- The domain part is the part of your Active Directory domain prior to the first dot.
- Type the user domain password, and press enter.
- You should be logged into a Fedora Desktop.
You can see verbose output in the terminal that you started gnome-control-center from.
Known Issue [Selinux]: You need to turn off selinux to complete the permit action. Please do:
$ sudo setenforce 0
Please file the all realmd AVC's at this bug: https://bugzilla.redhat.com/show_bug.cgi?id=867873
$ sudo grep realmd /var/log/audit/audit.log