Join the current machine to an Active Directory domain using winbind as an AD client. Domain accounts are available on the local machine once this is done.
- Verify that your Active Directory domain access works. If you don't have an Active Directory domain, you can set one up.
- You need a domain account, either a user or administrator. It's useful to test with both.
- Your machine must have a configured host name. Do not proceed if you host name is
- Make sure you have realmd 0.10 or later installed.
$ yum list realmd
- Remove the following packages, they should be installed by realmd as necessary.
$ yum remove samba-winbind samba-client
How to test
- Perform the join command. Use the
--user=xxxargument to specify your domain account name.
$ realm join --user=User --client-software=winbind ad.example.com
- You will be prompted for Policy Kit authorization.
- You will be prompted for a password for the account.
- On a successful join there will be no output.
- This can take up to a few minutes depending on how far away your Active Directory domain is.
- Check that the domain is now configured.
$ realm list
- Make sure the domain is listed.
- Make sure you have a
configured: kerberos-memberline in the output.
- Make sure you have a
client-software: winbindline in the output.
- Make note of the
login-formatsline for the next command.
- Check that you can resolve domain accounts on the local computer.
$ getent passwd 'AD\User'
- Make sure to use the quotes around the user name.
- You should see an output line that looks like passwd(5) output. It should contain an appropriate home directory, and a shell.
- Use the
login-formatsyou saw above, to build a remote user name. It will be in the form of
DOMAIN\User, where DOMAIN is the first part of your full Active Directory domain name.
- Check that you have an appropriate entry in your hosts keytab.
sudo klist -k
- You should see several lines, with your host name. For example
- Check that you can use your keytab with kerberos
sudo kinit -k 'HOSTNAME$@AD.EXAMPLE.COM'
- Make sure to use quotes around the argument, because of the characters in there. Make sure the hostname and domain are capitalized.
- Use the principal from the output of the
klistcommand above. Use the one that's capitalized and looks like
- There should be no output from this command.
- If you have console access to a domain controller, you can use the Active Directory Users and Computers tool to see if that the computer account was created under the Computers section.
--verbose argument to see details of what's being done during a join. Include verbose output in any bug reports.
$ realm join --client-software=winbind --verbose ad.example.com
Known Issue [Selinux]: You need to turn off selinux to complete the join. Please do:
$ sudo setenforce 0
Please file the all realmd AVC's at this bug: https://bugzilla.redhat.com/show_bug.cgi?id=867873
$ sudo grep realmd /var/log/audit/audit.log