I have a couple of CentOS 7.5 Linux servers that I need to get them to join an Active Directory 2012 R2 domain, I tried using Winbind and it tells me it cannot join as standalone server, then I tried using realm and even though it seems like it joined, when I run "id user@example.com" I get a message saying user does not exist, I even tried to use it as an LDAP Client (using Webmin), but when I hit Validate configuration it says it cannot find any users in the DN, Any ideas what should check to make sure everything is correct?


  • 1
    What have you tried? What did you expect to happen? What happened instead? What does your configuration look like? Do you have any log entries from the time things didn't work as expected? – Jenny D Mar 4 at 19:57

From my installation notes:

To join a domain with an RHEL 7-compatible server:

yum install sssd sssd-ad adcli realmd oddjob oddjob-mkhomedir samba-common-tools
realm join -U [admin account] [domain]
realm deny --all
realm permit --realm=[domain] --groups 'domain admins' '[other groups]'

To set the domain as the username suffix, add the following line to the [sssd] section of /etc/sssd/sssd.conf:
default_domain_suffix = [domain]

To allow AD groups to sudo, run visudo and add the following lines under the line that starts with %wheel:

%domain\ admins@[domain]        ALL = (ALL) ALL
%[other groups]@[domain]        ALL = (ALL) ALL
  • All those packages are installed, I joined the domain and realm said: "* Successfully enrolled machine in realm", I ran the realm permit command(s) to allow users to login, but still after that when I run "id user@example.com" I still get: "id: user@example.com: no such user" I even enabled NIS in the Windows Server even though it has been deprecated by Microsoft. Any other ideas? Thanks – Jorge Hernandez Mar 5 at 20:16
  • It's probably not a good idea to enable deprecated services, and nothing in this setup should require it. If I don't misremember, sssd uses kerberos ("krb5") for authentication, and ldap for authorization. If you're able to log in with an AD user and you've limited access to specific AD groups, then both "should" be working. One step for further troubleshooting is to install the krb5-workstation package to get some tools like klist, which can help you confirm at least the kerberos status. – Mikael H Mar 6 at 9:25

Sorry for the delay, I found the problem, because these servers were using LDAP as previous Authentication, the /etc/krb5.conf file kept the configuration for LDAP, once I erased the line(s) for LDAP and left only the lines for AD, it worked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.