0

I have a couple of CentOS 7.5 Linux servers that I need to get them to join an Active Directory 2012 R2 domain, I tried using Winbind and it tells me it cannot join as standalone server, then I tried using realm and even though it seems like it joined, when I run "id [email protected]" I get a message saying user does not exist, I even tried to use it as an LDAP Client (using Webmin), but when I hit Validate configuration it says it cannot find any users in the DN, Any ideas what should check to make sure everything is correct?

Thanks,

Improve this question
1
  • 1
    What have you tried? What did you expect to happen? What happened instead? What does your configuration look like? Do you have any log entries from the time things didn't work as expected?
    – Jenny D
    Mar 4, 2019 at 19:57

2 Answers 2

Reset to default
0

From my installation notes:

To join a domain with an RHEL 7-compatible server:

yum install sssd sssd-ad adcli realmd oddjob oddjob-mkhomedir samba-common-tools
realm join -U [admin account] [domain]
realm deny --all
realm permit --realm=[domain] --groups 'domain admins' '[other groups]'

To set the domain as the username suffix, add the following line to the [sssd] section of /etc/sssd/sssd.conf:
default_domain_suffix = [domain]

To allow AD groups to sudo, run visudo and add the following lines under the line that starts with %wheel:

%domain\ admins@[domain]        ALL = (ALL) ALL
%[other groups]@[domain]        ALL = (ALL) ALL
Improve this answer
2
  • All those packages are installed, I joined the domain and realm said: "* Successfully enrolled machine in realm", I ran the realm permit command(s) to allow users to login, but still after that when I run "id [email protected]" I still get: "id: [email protected]: no such user" I even enabled NIS in the Windows Server even though it has been deprecated by Microsoft. Any other ideas? Thanks
    – Jorge Hernandez
    Mar 5, 2019 at 20:16
  • It's probably not a good idea to enable deprecated services, and nothing in this setup should require it. If I don't misremember, sssd uses kerberos ("krb5") for authentication, and ldap for authorization. If you're able to log in with an AD user and you've limited access to specific AD groups, then both "should" be working. One step for further troubleshooting is to install the krb5-workstation package to get some tools like klist, which can help you confirm at least the kerberos status.
    – Mikael H
    Mar 6, 2019 at 9:25
0

Sorry for the delay, I found the problem, because these servers were using LDAP as previous Authentication, the /etc/krb5.conf file kept the configuration for LDAP, once I erased the line(s) for LDAP and left only the lines for AD, it worked.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .