Clarify Computer, Not User, when integrating a Linux box with a Windows Domain.
Having confusion because most SSSD AD information focuses on User Authentication, however apparently in a Windows Domain, the computer to which the users logon should be in the domain already (as a service principal?). It seems to me I need a help to get to the bottom.
Question - Computer to join a Windows domain.
I believe there are several ways. Please suggest if below are correct.
- Run realm in the Linux box.
- Run Samba net ads join in the Linux box (Creating Host Keytab with Samba).
- Run setSPN and ktpass in the Domain Controller
Regarding using realm and samba, I suppose the command also will join the Linux box into the Domain and AD. It it correct? Also please point to resources to understand what is going on behind with regard to computer and domain if any.
These ways require an Administrator credential Or a user credentials who has the permission to add a computer to a domain, which would not always be available. Then I suppose need to ask a Windows domain administrator to do what realm and samba do. Which seem to me involving below but need corrections/confirmation if they are correct.
- Create a A record and reverse lookup PTR record in the domain DNS.
- Add a computer for the Linux box in the Computers management view. The UPN of the box will be
<linux hostname>@<realm or domain>.
- Create a SPN for the Linux box with setSPN. The SPN is like
host/<name>@<realm or domain>.
- Create a keytab with ktpass. The SPN is specified with -princ and the UPN is specified with -mapuser.
- Copy the keytab to the linux box as /etc/krb5.keytab and change permissions. (Treat like pem file in ~/.ssh/)
Question - UPN and SPN?
Why having multiple identifiers for the same object (linux box)? Why SPN is required?