SSSD and Active Directory integration

Joining a Linux host to Active Directory is the standard way to integrate Linux into a Windows-centric enterprise. This lesson walks through the configuration end-to-end.

Prerequisites

• An Active Directory domain with at least one Domain Controller.
• A Linux host with sssd-ad, realmd, adcli, krb5-user installed.
• DNS configured to find the DC (dc1.example.com resolves).
• Time synchronisation (NTP) configured.

Discover the realm

sudo realm discover example.com

Output:

example.com
  type: active-directory
  domain-name: example.com
  configured: no
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  ...

If the realm is not discovered, check DNS for the domain and the DC’s SRV records.

Join the domain

sudo realm join example.com --user=Administrator

Prompts for the AD admin password. The command:

• Creates a computer object in AD.
• Generates a Kerberos keytab for the host.
• Configures SSSD.
• Configures NSS and PAM.

After joining:

sudo realm list

Shows the joined domain.

Configure SSSD for AD

realm join generates /etc/sssd/sssd.conf. A typical AD config:

[sssd]
domains = example.com
config_file_version = 2
services = nss, pam

[domain/example.com]
ad_domain = example.com
krb5_realm = EXAMPLE.COM
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
access_provider = ad
fallback_homedir = /home/%u@%d
default_shell = /bin/bash

Configure sudo

To allow AD groups to use sudo:

sudo realm permit -g "linux-admins@example.com"    # full sudo
sudo realm permit -g "linux-users@example.com" --withtype=USER_TYPE_REGULAR

Or manually in /etc/sudoers.d/ad:

%linux-admins@example.com ALL=(ALL) ALL
%linux-users@example.com ALL=(ALL) NOPASSWD: /usr/bin/systemctl status

Configure SSH for Kerberos

# /etc/ssh/sshd_config
GSSAPIAuthentication yes
UsePAM yes

# /etc/ssh/ssh_config (client)
Host *.example.com
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials yes

Verify

getent passwd alice@EXAMPLE.COM       # user visible
kinit alice@EXAMPLE.COM              # get Kerberos TGT
klist                                # show tickets
ssh alice@server.example.com         # SSO, no password prompt

Common failure modes

Offline behaviour

For laptop users, SSSD caches credentials:

sudo sssctl domain-status example.com
# Online status: online

When offline:

sudo sssctl domain-status example.com
# Online status: offline
# cached credentials are used

Users can log in with cached credentials for up to offline_credentials_expiration days (default 30).

Knowledge check