Lab: Integrate a Linux host with Active Directory

This lab joins a Linux host to Active Directory with SSSD, configures Kerberos SSO, and tests offline behaviour. By the end you will have an AD-integrated host.

Objective

By the end of this lab, you can:

Join a Linux host to AD using realm.
Verify NSS/PAM integration with getent and login.
Configure SSH for Kerberos single sign-on.
Test offline behaviour by simulating a network outage.

Architecture

You need:

A Linux host with sssd-ad, realmd, adcli, krb5-user installed.
An AD domain with at least one Domain Controller (DC).
DNS configured to find the DC.
NTP configured and synchronised.

If you do not have a real AD environment, you can stand one up in a VM (Active Directory Domain Services role).

Tasks

Task 1: Configure prerequisites

# Install required packages
sudo apt install sssd-ad sssd-tools realmd adcli krb5-user

# Verify DNS
dig dc1.example.com
dig _ldap._tcp.example.com SRV
dig _kerberos._tcp.example.com SRV

# Verify NTP
chronyc tracking

All DNS lookups should return the expected results. NTP should show <100 ms skew.

Task 2: Discover the realm

sudo realm discover example.com

Should return the realm configuration. If not, fix DNS.

Task 3: Join the domain

sudo realm join example.com --user=Administrator

Prompts for the AD admin password. Verify:

sudo realm list

Shows the joined domain.

Task 4: Verify NSS integration

getent passwd administrator@example.com
id administrator@example.com

The AD user should be visible via NSS.

Task 5: Verify PAM integration

ssh administrator@example.com@localhost

Should prompt for the AD password (since this is the first login, no TGT yet).

After login, verify:

sudo -l -U administrator@example.com

Task 6: Configure Kerberos SSO

Get a TGT:

kinit administrator@EXAMPLE.COM
klist

SSH with SSO:

ssh administrator@example.com@localhost    # no password prompt

The kinit command authenticated; the SSH session uses the TGT.

Task 7: Configure SSH for Kerberos

# /etc/ssh/sshd_config
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes

# /etc/ssh/ssh_config
Host *.example.com
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials yes

Restart sshd:

sudo systemctl restart sshd

Task 8: Configure sudo

sudo realm permit -g "linux-admins@example.com"

Task 9: Test offline behaviour

Configure cache_credentials = true (default):

# /etc/sssd/sssd.conf
[domain/example.com]
cache_credentials = True

# Stop SSSD
sudo systemctl stop sssd

# Wait for offline mode
sleep 60

# Try login
ssh administrator@example.com@localhost

Should succeed with cached credentials.

Restart SSSD:

sudo systemctl start sssd
sssctl domain-status example.com

Task 10: Document the integration

AD INTEGRATION
==============
Host: <host>
Realm: EXAMPLE.COM
DC: dc1.example.com, dc2.example.com
Join procedure: sudo realm join example.com --user=Administrator

SSSD: enabled, services nss+pam
Kerberos: enabled, SSO via TGT
Sudo: linux-admins group allowed

Offline credentials: 30 days
Local break-glass: breakglass user, password in vault

Verification:
- getent passwd administrator@example.com returns AD user
- kinit works, klist shows TGT
- ssh administrator@example.com@localhost works without password prompt
- offline login works after SSSD is stopped

Validation

The host is joined to AD (realm list).
AD users are visible via getent.
SSH login with Kerberos TGT works without password.
Sudo works for the linux-admins group.
Offline login works with cached credentials.

Cleanup

Leave the domain:

sudo realm leave example.com

This removes the computer object from AD and cleans up Kerberos state.

What you learned

Joining AD with realm is one command but depends on DNS, NTP, and SSSD working.
SSO requires Kerberos TGT and GSSAPIAuthentication.
Offline credentials cache for resilience.
Local break-glass accounts are the last resort.

Objectives

Prerequisites