Otdfbt

Multi tool use

Would encrypting a database protect against a compromised admin account?

Does the 500 feet falling cap apply per fall, or per turn?

Why does it take longer to fly from London to Xi'an than to Beijing

No such column 'DeveloperName' on entity 'RecordType' after Summer '19 release on sandbox

Which other programming languages apart from Python and predecessor are out there using indentation to define code blocks?

Why was wildfire not used during the Battle of Winterfell?

Remove color cast in darktable?

Can more than one creature benefit from multiple Hunter's Mark spells cast on the same target?

What is the name of meteoroids which hit Moon, Mars, or pretty much anything that isn’t the Earth?

What does formal training in a field mean?

Is there a need for better software for writers?

Print a string of characters with their occurrences

Is it a Munchausen Number?

Is a vertical stabiliser needed for straight line flight in a glider?

Further factorisation of a difference of cubes?

Is every story set in the future "science fiction"?

Is it a good idea to copy a trader when investing?

How to get my matrix to fit on the page

My perfect evil overlord plan... or is it?

Cropping a message using array splits

date to display the EDT time

Why does a variable size struct not compile in the Arduino IDE?

What's the difference between const array and static const array in C/C++

Passport stamps art, can it be done?

Joining an Active Directory with Linux

Active directory with duplicate machine SIDsConnecting a linux client into active directoryCan't add my Red Hat 7 machine to our company's Active DirectoryThe user name or password is incorrect error while joining Windows domainWhat is ADFS (Active Directory Federation Services)?Removing a “semi joined” Ubuntu workstation from an Active Directory domainProblems joining Ubuntu desktop to Active Directory domain using SambaSamba 4.2.10 on Debian 6.5 file share with windows active directory usersconfigure linux login against active directory ldap

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

0

I have a couple of CentOS 7.5 Linux servers that I need to get them to join an Active Directory 2012 R2 domain, I tried using Winbind and it tells me it cannot join as standalone server, then I tried using realm and even though it seems like it joined, when I run "id user@example.com" I get a message saying user does not exist, I even tried to use it as an LDAP Client (using Webmin), but when I hit Validate configuration it says it cannot find any users in the DN, Any ideas what should check to make sure everything is correct?

Thanks,

linux active-directory

share|improve this question

asked Mar 4 at 19:11

Jorge HernandezJorge Hernandez

11

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  What have you tried? What did you expect to happen? What happened instead? What does your configuration look like? Do you have any log entries from the time things didn't work as expected?
  
  – Jenny D
  Mar 4 at 19:57
  

  
  
  
  

add a comment | 

0

I have a couple of CentOS 7.5 Linux servers that I need to get them to join an Active Directory 2012 R2 domain, I tried using Winbind and it tells me it cannot join as standalone server, then I tried using realm and even though it seems like it joined, when I run "id user@example.com" I get a message saying user does not exist, I even tried to use it as an LDAP Client (using Webmin), but when I hit Validate configuration it says it cannot find any users in the DN, Any ideas what should check to make sure everything is correct?

Thanks,

linux active-directory

share|improve this question

asked Mar 4 at 19:11

Jorge HernandezJorge Hernandez

11

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  What have you tried? What did you expect to happen? What happened instead? What does your configuration look like? Do you have any log entries from the time things didn't work as expected?
  
  – Jenny D
  Mar 4 at 19:57
  

  
  
  
  

add a comment | 

I have a couple of CentOS 7.5 Linux servers that I need to get them to join an Active Directory 2012 R2 domain, I tried using Winbind and it tells me it cannot join as standalone server, then I tried using realm and even though it seems like it joined, when I run "id user@example.com" I get a message saying user does not exist, I even tried to use it as an LDAP Client (using Webmin), but when I hit Validate configuration it says it cannot find any users in the DN, Any ideas what should check to make sure everything is correct?

Thanks,

linux active-directory

share|improve this question

asked Mar 4 at 19:11

Jorge HernandezJorge Hernandez

11

share|improve this question

asked Mar 4 at 19:11

Jorge HernandezJorge Hernandez

11

share|improve this question

asked Mar 4 at 19:11

Jorge HernandezJorge Hernandez

11

asked Mar 4 at 19:11

Jorge HernandezJorge Hernandez

11

asked Mar 4 at 19:11

Jorge HernandezJorge Hernandez

11

2 Answers
2

active

oldest

votes

0

From my installation notes:

To join a domain with an RHEL 7-compatible server:

yum install sssd sssd-ad adcli realmd oddjob oddjob-mkhomedir samba-common-tools
realm join -U [admin account] [domain]
realm deny --all
realm permit --realm=[domain] --groups 'domain admins' '[other groups]'

To set the domain as the username suffix, add the following line to the [sssd] section of /etc/sssd/sssd.conf:
default_domain_suffix = [domain]

To allow AD groups to sudo, run visudo and add the following lines under the line that starts with %wheel:

%domain admins@[domain] ALL = (ALL) ALL
%[other groups]@[domain] ALL = (ALL) ALL

share|improve this answer

answered Mar 4 at 20:45

Mikael HMikael H

811210

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  All those packages are installed, I joined the domain and realm said: "* Successfully enrolled machine in realm", I ran the realm permit command(s) to allow users to login, but still after that when I run "id user@example.com" I still get: "id: user@example.com: no such user" I even enabled NIS in the Windows Server even though it has been deprecated by Microsoft. Any other ideas? Thanks
  
  – Jorge Hernandez
  Mar 5 at 20:16
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  It's probably not a good idea to enable deprecated services, and nothing in this setup should require it. If I don't misremember, sssd uses kerberos ("krb5") for authentication, and ldap for authorization. If you're able to log in with an AD user and you've limited access to specific AD groups, then both "should" be working. One step for further troubleshooting is to install the krb5-workstation package to get some tools like klist, which can help you confirm at least the kerberos status.
  
  – Mikael H
  Mar 6 at 9:25
  

  
  
  
  

add a comment | 

0

Sorry for the delay, I found the problem, because these servers were using LDAP as previous Authentication, the /etc/krb5.conf file kept the configuration for LDAP, once I erased the line(s) for LDAP and left only the lines for AD, it worked.

share|improve this answer

answered Apr 30 at 22:08

Jorge HernandezJorge Hernandez

11

add a comment | 

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f956699%2fjoining-an-active-directory-with-linux%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

0

From my installation notes:

To join a domain with an RHEL 7-compatible server:

yum install sssd sssd-ad adcli realmd oddjob oddjob-mkhomedir samba-common-tools
realm join -U [admin account] [domain]
realm deny --all
realm permit --realm=[domain] --groups 'domain admins' '[other groups]'

To set the domain as the username suffix, add the following line to the [sssd] section of /etc/sssd/sssd.conf:
default_domain_suffix = [domain]

To allow AD groups to sudo, run visudo and add the following lines under the line that starts with %wheel:

%domain admins@[domain] ALL = (ALL) ALL
%[other groups]@[domain] ALL = (ALL) ALL

share|improve this answer

answered Mar 4 at 20:45

Mikael HMikael H

811210

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  All those packages are installed, I joined the domain and realm said: "* Successfully enrolled machine in realm", I ran the realm permit command(s) to allow users to login, but still after that when I run "id user@example.com" I still get: "id: user@example.com: no such user" I even enabled NIS in the Windows Server even though it has been deprecated by Microsoft. Any other ideas? Thanks
  
  – Jorge Hernandez
  Mar 5 at 20:16
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  It's probably not a good idea to enable deprecated services, and nothing in this setup should require it. If I don't misremember, sssd uses kerberos ("krb5") for authentication, and ldap for authorization. If you're able to log in with an AD user and you've limited access to specific AD groups, then both "should" be working. One step for further troubleshooting is to install the krb5-workstation package to get some tools like klist, which can help you confirm at least the kerberos status.
  
  – Mikael H
  Mar 6 at 9:25
  

  
  
  
  

add a comment | 

0

From my installation notes:

To join a domain with an RHEL 7-compatible server:

yum install sssd sssd-ad adcli realmd oddjob oddjob-mkhomedir samba-common-tools
realm join -U [admin account] [domain]
realm deny --all
realm permit --realm=[domain] --groups 'domain admins' '[other groups]'

To set the domain as the username suffix, add the following line to the [sssd] section of /etc/sssd/sssd.conf:
default_domain_suffix = [domain]

To allow AD groups to sudo, run visudo and add the following lines under the line that starts with %wheel:

%domain admins@[domain] ALL = (ALL) ALL
%[other groups]@[domain] ALL = (ALL) ALL

share|improve this answer

answered Mar 4 at 20:45

Mikael HMikael H

811210

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  All those packages are installed, I joined the domain and realm said: "* Successfully enrolled machine in realm", I ran the realm permit command(s) to allow users to login, but still after that when I run "id user@example.com" I still get: "id: user@example.com: no such user" I even enabled NIS in the Windows Server even though it has been deprecated by Microsoft. Any other ideas? Thanks
  
  – Jorge Hernandez
  Mar 5 at 20:16
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  It's probably not a good idea to enable deprecated services, and nothing in this setup should require it. If I don't misremember, sssd uses kerberos ("krb5") for authentication, and ldap for authorization. If you're able to log in with an AD user and you've limited access to specific AD groups, then both "should" be working. One step for further troubleshooting is to install the krb5-workstation package to get some tools like klist, which can help you confirm at least the kerberos status.
  
  – Mikael H
  Mar 6 at 9:25
  

  
  
  
  

add a comment | 

From my installation notes:

To join a domain with an RHEL 7-compatible server:

yum install sssd sssd-ad adcli realmd oddjob oddjob-mkhomedir samba-common-tools
realm join -U [admin account] [domain]
realm deny --all
realm permit --realm=[domain] --groups 'domain admins' '[other groups]'

To set the domain as the username suffix, add the following line to the [sssd] section of /etc/sssd/sssd.conf:
default_domain_suffix = [domain]

To allow AD groups to sudo, run visudo and add the following lines under the line that starts with %wheel:

%domain admins@[domain] ALL = (ALL) ALL
%[other groups]@[domain] ALL = (ALL) ALL

share|improve this answer

answered Mar 4 at 20:45

Mikael HMikael H

811210

yum install sssd sssd-ad adcli realmd oddjob oddjob-mkhomedir samba-common-tools
realm join -U [admin account] [domain]
realm deny --all
realm permit --realm=[domain] --groups 'domain admins' '[other groups]'

%domain admins@[domain] ALL = (ALL) ALL
%[other groups]@[domain] ALL = (ALL) ALL

share|improve this answer

answered Mar 4 at 20:45

Mikael HMikael H

811210

answered Mar 4 at 20:45

Mikael HMikael H

811210

answered Mar 4 at 20:45

Mikael HMikael H

811210

0

Sorry for the delay, I found the problem, because these servers were using LDAP as previous Authentication, the /etc/krb5.conf file kept the configuration for LDAP, once I erased the line(s) for LDAP and left only the lines for AD, it worked.

share|improve this answer

answered Apr 30 at 22:08

Jorge HernandezJorge Hernandez

11

add a comment | 

0

Sorry for the delay, I found the problem, because these servers were using LDAP as previous Authentication, the /etc/krb5.conf file kept the configuration for LDAP, once I erased the line(s) for LDAP and left only the lines for AD, it worked.

share|improve this answer

answered Apr 30 at 22:08

Jorge HernandezJorge Hernandez

11

add a comment | 

Sorry for the delay, I found the problem, because these servers were using LDAP as previous Authentication, the /etc/krb5.conf file kept the configuration for LDAP, once I erased the line(s) for LDAP and left only the lines for AD, it worked.

share|improve this answer

answered Apr 30 at 22:08

Jorge HernandezJorge Hernandez

11

share|improve this answer

answered Apr 30 at 22:08

Jorge HernandezJorge Hernandez

11

answered Apr 30 at 22:08

Jorge HernandezJorge Hernandez

11

answered Apr 30 at 22:08

Jorge HernandezJorge Hernandez

11