Authenticating Linux Login against Active Directory (AD) without Joining Linux Machine to AD Domain

Question

I have a conventional Active Directory Infra deployed on Windows VMs on Azure. There is no Integration of this convention AD with Azure AD.

I want Linux VMs on Azure with SLES 12 SP3 to authenticate against our conventional AD setup, without needing to join the AD domain at all.

The flow should happen like this:

• While a user logs into the non-domain joined SLES12SP3 VM, authentication should be performed against our conventional AD to check for credentials.
• If success, check for mapping with the local user with the name "name@domain".
• If the local user does not exist but authenticated successfully through our AD, creates the new user and home directory

I have tried PAM module authentication with KRB5 and SSSD but to no avail to achieve my desired scenario. I suspect I might be missing any settings in the config files for KRB5 or SSSD, or maybe this scenario cannot be achieved?

Please help. Thanks in advance.

Answer 1

There used to be an Identity Management for Unix piece of AD that would allow you to specify home directories, user shells and other Posix attributes and allow users to authenticate from Linux via AD. This is no longer the case. As of Server 2008 that piece has been deprecated. You can try using ADSI Edit to set values by hand but the free-form entry can make things a mess if you're not careful. I don't know if there is a way to keep track of Unix UID/GID in a reasonable way either so as you don't end up duplicating them. I ended up going with SASL Passthrough. You have to find a way to manage it but in the end you're only asking AD for a password and nothing else. All the Posix attributes come from OpenLDAP. Running the bulk of it on Linux offers many tools for automating the management of the directory.