Join the current machine to an Active Directory domain using sssd as an AD client. Domain accounts are available on the local machine once this is done.
- Make sure you have other required software:
- realmd 0.14.0 or later
- adcli 0.7 or later
- Verify that your Active Directory domain access works, or set a domain up.
- You need a domain account, either a user or administrator. It's useful to test with both.
- Your machine must have a configured host name. Do not proceed if you host name is
- Remove the following packages, they should be installed by realmd as necessary.
$ sudo yum remove sssd samba-client
How to test
- Perform the join command. Use the
--user=xxxargument to specify your domain account name.
$ realm join --user=User ad.example.com
- You will be prompted for a password for the account.
- You will be prompted for Policy Kit authorization.
- On a successful join there will be no output.
- This can take up to a few minutes depending on how far away your Active Directory domain is.
- Check that the domain is now configured.
$ realm list
- Make sure the domain is listed.
- Make sure you have a
configured: kerberos-memberline in the output.
- Make note of the
login-formatsline for the next command.
- Check that you can resolve domain accounts on the local computer.
$ getent passwd 'AD\User'
- Make sure to use the quotes around the user name.
- You should see an output line that looks like passwd(5) output. It should contain an appropriate home directory, and a shell.
- Use the
login-formatsyou saw above, to build a remote user name. It will be in the form of
DOMAIN\User, where DOMAIN is the first part of your full Active Directory domain name.
- Check that you have an appropriate entry in your hosts keytab.
sudo klist -k
- You should see several lines, with your host name. For example
- Check that you can use your keytab with kerberos
sudo kinit -k 'HOSTNAME$@AD.EXAMPLE.COM'
- Make sure to use quotes around the argument, because of the characters in there. Make sure the hostname and domain are capitalized.
- Use the principal from the output of the
klistcommand above. Use the one that's capitalized and looks like
- There should be no output from this command.
- If you have console access to a domain controller, you can use the Active Directory Users and Computers tool to see if that the computer account was created under the Computers section.
--verbose argument to see details of what's being done during a join. Include verbose output in any bug reports.
$ realm join --verbose ad.example.com